A phishing tool that helped criminals steal login credentials from tens of thousands of people around the world has been taken down, and its alleged developer is now in custody in Indonesia.
What happened: The FBI’s Atlanta office and Indonesian law enforcement seized the online infrastructure behind a cybercrime tool called the W3LL phishing kit. Indonesian police detained the alleged developer, identified only as G.L. Investigators also seized key internet domains tied to the operation.
How the tool worked: For about $500, criminals could buy access to the kit and use it to build fake websites that looked nearly identical to real login pages. When victims typed in their usernames and passwords, the tool captured that information. It also grabbed session data, which let criminals get around multi-factor authentication, the security feature that sends a second verification code to a user’s phone or email. The operation attempted more than $20 million in fraud.
The marketplace: The kit was sold through an online storefront called W3LLSTORE, where criminals could also buy and sell stolen account credentials and unauthorized access to other people’s computers. Between 2019 and 2023, the marketplace facilitated the sale of more than 25,000 compromised accounts before shutting down in 2023.
After the shutdown: The tool did not disappear when W3LLSTORE closed. It was rebranded and sold through encrypted messaging platforms. Between 2023 and 2024, the kit was used to target more than 17,000 victims worldwide. The developer also collected and resold access to accounts that had already been compromised.
The path forward: This is the first time U.S. and Indonesian authorities have taken coordinated action against a phishing kit developer. The U.S. Attorney’s Office for the Northern District of Georgia was involved in identifying and seizing the operation’s infrastructure.
B.T. Clark
B.T. Clark is an award-winning journalist and the Publisher of The Georgia Sun. He has 25 years of experience in journalism and served as Managing Editor of Neighbor Newspapers in metro Atlanta for 15 years and Digital Director at Times-Journal Inc. for 8 years. His work has appeared in several newspapers throughout the state including Neighbor Newspapers, The Cherokee Tribune and The Marietta Daily Journal. He is a Georgia native and a fifth-generation Georgian.
