W3LL Unmasked

Group-IB details the discovery and disruption of the W3LL phishing ecosystem — a private phishing-as-a-service marketplace (W3LL Store) and a sophisticated AiTM phishing kit (W3LL Panel) used since 2017 to enable business email compromise (BEC) campaigns worldwide; investigators linked custom tooling, infrastructure and 700+ weaponized attachments to over 500 criminals and victims across multiple industries, documented operational TTPs and indicators, and shared findings with law enforcement to mitigate further attacks.