Authorities Dismantle ‘W3LL’ Phishing Empire Powering Global Business Email Attacks

An international operation led by the FBI Atlanta Field Office and Indonesian law enforcement disrupted the W3LL phishing-as-a-service ecosystem, which facilitated credential harvesting and sale (over 25,000 compromised accounts traded), enabled more than $20 million in attempted fraud, targeted corporate email systems (notably Microsoft 365), used adversary-in-the-middle techniques to bypass MFA, and involved roughly 500 threat actors; domains and infrastructure were seized and a suspected developer was detained.