ATLANTA - The FBI Atlanta Field Office and Indonesian law enforcement authorities dismantled a sophisticated global phishing operation that enabled cybercriminals to steal thousands of victims’ account credentials and attempt more than $20 million in fraud.
The operation centered on a tool called the "W3LL phishing kit." This cybercrime platform allowed criminals to impersonate legitimate login pages to trick victims into handing over their usernames and passwords. For a fee of $500, users could purchase access to the kit and deploy fake websites designed to look nearly identical to trusted portals.
The tool was supported by an online marketplace called "W3LLSTORE." Between 2019 and 2023, the marketplace facilitated the sale of more than 25,000 compromised accounts. Even after the store shut down in 2023, the operation continued through encrypted messaging apps where the tool was rebranded.
Authorities have not released the full name of the alleged developer, identifying them only as G.L. It is also unclear how many individual victims in Georgia were specifically targeted by the 17,000 global phishing attempts recorded between 2023 and 2024.
"This wasn’t just phishing—it was a full-service cybercrime platform," said FBI Atlanta Special Agent in Charge Marlo Graham. "We will continue to work with our domestic and foreign law enforcement partners, using all available tools to protect the public."
The takedown cuts off a major resource used by cybercriminals. The FBI Atlanta Field Office noted that this case represents the first coordinated action against a phishing kit developer between the United States and Indonesia.
The Source: The information in this story was gathered from the FBI Atlanta Field Office and the U.S. Attorney’s Office for the Northern District of Georgia.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
