Loading story…
The FBI Atlanta Field Office and the Indonesian National Police dismantled infrastructure tied to the W3LL phishing operation, seized associated domains, and detained an alleged developer identified as G.L. Authorities said the platform enabled more than $20 million in attempted fraud by selling a low-cost phishing kit and operating W3LLSTORE, a marketplace that trafficked stolen credentials and unauthorized access. Investigators said the service sold kits for about $500, supported roughly 500 threat actors, and facilitated the sale of more than 25,000 compromised accounts between 2019 and 2023.
Researchers and law enforcement described W3LL as a full-service phishing and business email compromise platform used in more than 17,000 attacks worldwide from 2023 to 2024, with the United States accounting for more than half of identified cases. Group-IB, Hunt.io, and Sekoia linked the operation to Microsoft 365-focused adversary-in-the-middle phishing, session cookie theft, MFA bypass, and code reuse in other kits such as Sneaky 2FA. Authorities said the operation continued on encrypted messaging platforms after W3LLSTORE shut down in 2023, underscoring how commercial phishing services lowered the barrier for attacks against sectors including manufacturing, technology, and professional services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The FBI said the W3LL takedown marked the first coordinated enforcement action between the United States and Indonesia against a phishing kit developer. The announcement framed the seizure of infrastructure and detention of alleged developer G.L. as a milestone in bilateral cybercrime cooperation.
As part of the takedown, Indonesian authorities detained an alleged developer of the W3LL platform identified as G.L. Officials said the action was intended to disrupt both the users of the phishing kit and the developers supplying it.
The FBI Atlanta Field Office and the Indonesian National Police disrupted the W3LL phishing operation by seizing infrastructure and domains tied to the scheme. Authorities said the network was linked to more than $20 million in attempted fraud.
Security firms including Group-IB, Hunt.io, and Sekoia publicly connected W3LL to adversary-in-the-middle phishing, session cookie theft, MFA bypass, and code reuse in other kits such as Sneaky 2FA. These findings expanded understanding of the toolkit's technical capabilities and ecosystem.
From 2023 to 2024, the W3LL phishing kit was used in more than 17,000 attacks globally. Group-IB linked the activity to campaigns targeting corporate environments, especially Microsoft 365 accounts, with the United States accounting for more than half of identified cases.
Between 2019 and 2023, W3LLSTORE enabled the sale of more than 25,000 compromised accounts. Researchers said the platform served roughly 500 threat actors and helped scale credential theft and business email compromise activity.
In 2023, the W3LLSTORE marketplace ceased operating. Authorities said the broader phishing operation did not end and instead shifted to encrypted messaging platforms.
By 2019, the W3LL operation was active as a full-service cybercrime platform, selling a phishing kit for about $500 and offering related services through the W3LLSTORE marketplace. The marketplace supported trafficking in stolen credentials, compromised servers, mailing lists, and unauthorized system access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceinfosec.pub
Open sourcehelpnetsecurity.com
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**INTERPOL** said **Operation Synergia III** led to the arrest of **94 suspects**, the seizure of **212 devices and servers**, and the sinkholing or takedown of more than **45,000 malicious IP addresses** tied to cybercrime infrastructure across **72 countries and territories**. The operation ran from July 2025 through January 2026 and targeted infrastructure supporting **phishing, malware, ransomware, romance scams, credit card fraud, and related online fraud**. Authorities said **110 additional individuals remain under investigation**, underscoring that follow-on enforcement activity is still ongoing. Preliminary case details show broad international participation and a focus on both technical infrastructure and fraud operators. In **Macau**, investigators identified more than **33,000 phishing and fraudulent websites**, including fake casino, banking, government, payment, and other critical-service sites used to steal credentials and payment data. In **Bangladesh**, authorities arrested **40 suspects** and seized **134 devices** linked to loan scams, employment scams, identity theft, and credit card fraud, while in **Togo** police arrested **10 suspects** tied to a fraud ring whose members split responsibilities between account compromise and social-engineering schemes such as romance and sextortion scams. The reporting describes a coordinated law-enforcement disruption of active criminal infrastructure rather than a vendor announcement or generic security guidance.
Jun 29, 2026
INTERPOL, the Algerian National Police, and Group-IB dismantled **SniperDZ**, a phishing-as-a-service ecosystem that operated for nearly a decade and enabled large-scale credential theft, personal-data harvesting, and browser-based fraud. Investigators said the operation distributed about **80 free phishing templates** through Telegram and Facebook channels, impersonated roughly **30 major online platforms**, and relied on more than **20,000 domains** to host fake login pages. Group-IB attributed the infrastructure to a threat actor known as **Guedz** after analyzing tutorial videos that exposed an administrator panel and backend email addresses; Algerian authorities then arrested the suspect and seized hardware containing phishing code and malicious scripts. Researchers said SniperDZ also functioned as a centralized push-notification abuse platform used heavily across the Middle East and North Africa. Campaigns used fake Facebook and Instagram posts impersonating politicians, public figures, and telecom providers to lure victims with offers such as free mobile data, compensation, and subsidy programs, then redirected them through link shorteners and attacker-controlled chains to phishing pages that requested browser notification permissions. Group-IB linked multiple campaigns to the same ecosystem through a recurring **VAPID public key** and infrastructure hosted on **Horizon IS**, and documented cloaking, browser-history manipulation, and tab-under techniques used to evade detection while monetizing victims through unsolicited ads, scams, and malicious content. The takedown formed part of **Operation Ramz**, which spanned 13 countries and resulted in **201 arrests**, **53 malicious servers seized**, and **3,867 compromised endpoints and victims identified**.
Jun 29, 2026
Researchers disclosed two large phishing operations that used legitimate or compromised infrastructure to impersonate trusted brands and harvest victim data at scale. Group-IB said the **GitBait** campaign targeted at least 24 financial institutions in Mexico over more than three years by abusing GitHub Pages to host fake banking portals across more than 200 domains. The kit used client-side JavaScript to capture credentials and exfiltrate them through the SheetBest API into attacker-controlled Google Sheets, while at least one variant also forwarded data to a Telegram bot. Investigators said the modular phishing kit supported desktop and mobile devices and included an internal selector to switch between bank brands, complicating detection and takedown efforts. A separate campaign targeted millions of UK shoppers with fake **Boots** emails promising a free beauty sample pack and directing victims to a bogus survey and checkout page hosted on a compromised Bolivian government website. Researchers linked that activity to Romanian threat actors and found the emails were sent with **Gammadyne Mailer** installed on a compromised UK business terminal server, masking the operation behind the victim organization's internet connection. The same toolkit has reportedly appeared on multiple compromised systems since July 2025 and has also been used in tax-themed and cryptocurrency lures, underscoring a broader effort to exploit trusted brands, public-sector websites, and hijacked business infrastructure for credential and personal-data theft.
Jun 29, 2026