Loading story…
Indonesian authorities, INTERPOL, and Group-IB said a joint law-enforcement effort dubbed Operation Night Fury led to the arrest of three suspected operators of the GetBilling JavaScript-sniffer group in Indonesia. Investigators linked the gang to the compromise of hundreds of ecommerce websites in multiple countries, where malicious web skimming code was used to steal payment-card details and personal information from thousands of online shoppers across Asia, Europe, and the Americas.
According to the investigation, the suspects allegedly relied on VPN services, stolen payment cards, and infrastructure hosted partly in Indonesia to run the operation and convert stolen data into profit by buying goods for resale. The case was described as the first successful multi-jurisdictional takedown of JavaScript-sniffer operators in the APAC region, and authorities said related investigations remained active in five other ASEAN countries.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
In December 2019, Indonesian authorities, INTERPOL, and Group-IB's APAC Cyber Investigations Team carried out Operation Night Fury, arresting three suspected GetBilling operators in Yogyakarta and Jakarta. Indonesian Cyber Police also seized laptops, phones, CPU units, IDs, a BCA token, and ATM cards.
The article states that in December 2019, JavaScript sniffers infected the website of Singaporean fashion brand Love, Bonito, illustrating the ongoing threat from this malware category.
Group-IB's 2019 report, titled "Crime without punishment," first described the GetBilling family and documented the broader JavaScript-sniffer threat landscape.
Group-IB said it had been tracking the GetBilling JavaScript-sniffer family since 2018 as the malware infected ecommerce websites and stole shoppers' payment and personal data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**INTERPOL** said **Operation Synergia III** led to the arrest of **94 suspects**, the seizure of **212 devices and servers**, and the sinkholing or takedown of more than **45,000 malicious IP addresses** tied to cybercrime infrastructure across **72 countries and territories**. The operation ran from July 2025 through January 2026 and targeted infrastructure supporting **phishing, malware, ransomware, romance scams, credit card fraud, and related online fraud**. Authorities said **110 additional individuals remain under investigation**, underscoring that follow-on enforcement activity is still ongoing. Preliminary case details show broad international participation and a focus on both technical infrastructure and fraud operators. In **Macau**, investigators identified more than **33,000 phishing and fraudulent websites**, including fake casino, banking, government, payment, and other critical-service sites used to steal credentials and payment data. In **Bangladesh**, authorities arrested **40 suspects** and seized **134 devices** linked to loan scams, employment scams, identity theft, and credit card fraud, while in **Togo** police arrested **10 suspects** tied to a fraud ring whose members split responsibilities between account compromise and social-engineering schemes such as romance and sextortion scams. The reporting describes a coordinated law-enforcement disruption of active criminal infrastructure rather than a vendor announcement or generic security guidance.
Jun 29, 2026
INTERPOL, the Algerian National Police, and Group-IB dismantled **SniperDZ**, a phishing-as-a-service ecosystem that operated for nearly a decade and enabled large-scale credential theft, personal-data harvesting, and browser-based fraud. Investigators said the operation distributed about **80 free phishing templates** through Telegram and Facebook channels, impersonated roughly **30 major online platforms**, and relied on more than **20,000 domains** to host fake login pages. Group-IB attributed the infrastructure to a threat actor known as **Guedz** after analyzing tutorial videos that exposed an administrator panel and backend email addresses; Algerian authorities then arrested the suspect and seized hardware containing phishing code and malicious scripts. Researchers said SniperDZ also functioned as a centralized push-notification abuse platform used heavily across the Middle East and North Africa. Campaigns used fake Facebook and Instagram posts impersonating politicians, public figures, and telecom providers to lure victims with offers such as free mobile data, compensation, and subsidy programs, then redirected them through link shorteners and attacker-controlled chains to phishing pages that requested browser notification permissions. Group-IB linked multiple campaigns to the same ecosystem through a recurring **VAPID public key** and infrastructure hosted on **Horizon IS**, and documented cloaking, browser-history manipulation, and tab-under techniques used to evade detection while monetizing victims through unsolicited ads, scams, and malicious content. The takedown formed part of **Operation Ramz**, which spanned 13 countries and resulted in **201 arrests**, **53 malicious servers seized**, and **3,867 compromised endpoints and victims identified**.
Jun 29, 2026
The FBI Atlanta Field Office and the Indonesian National Police dismantled infrastructure tied to the **W3LL** phishing operation, seized associated domains, and detained an alleged developer identified as **G.L.** Authorities said the platform enabled more than **$20 million** in attempted fraud by selling a low-cost phishing kit and operating **W3LLSTORE**, a marketplace that trafficked stolen credentials and unauthorized access. Investigators said the service sold kits for about **$500**, supported roughly **500 threat actors**, and facilitated the sale of more than **25,000** compromised accounts between 2019 and 2023. Researchers and law enforcement described W3LL as a full-service phishing and business email compromise platform used in more than **17,000 attacks worldwide** from 2023 to 2024, with the United States accounting for more than half of identified cases. Group-IB, Hunt.io, and Sekoia linked the operation to **Microsoft 365**-focused adversary-in-the-middle phishing, session cookie theft, **MFA bypass**, and code reuse in other kits such as **Sneaky 2FA**. Authorities said the operation continued on encrypted messaging platforms after W3LLSTORE shut down in 2023, underscoring how commercial phishing services lowered the barrier for attacks against sectors including manufacturing, technology, and professional services.
Jun 29, 2026