FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts

The FBI, in coordination with the Indonesian National Police, dismantled the infrastructure behind the W3LL phishing kit and detained the alleged developer (identified as G.L.). W3LL enabled adversary-in-the-middle phishing that harvested credentials and hijacked session cookies to bypass multi-factor authentication—primarily targeting Microsoft 365—was marketed via an underground storefront to hundreds of threat actors, sold more than 25,000 compromised accounts between 2019–2023, and was linked to over $20 million in attempted fraud and thousands of victims worldwide.