In a major crackdown on cybercrime, authorities have shut down a large-scale phishing operation that enabled criminals to steal sensitive data and attempt fraud worth over $20 million.
The operation was jointly taken down by law enforcement agencies from the United States and Indonesia. It revolved around a tool known as the “W3LL phishing kit,” which allowed attackers to create fake login pages that closely resembled legitimate websites. Victims unknowingly entered their credentials, which were then captured by the system.
Beyond usernames and passwords, the tool also collected session data. This allowed attackers to bypass multi-factor authentication, giving them deeper access to user accounts. The phishing kit was sold for around $500, making it easily accessible to cybercriminals.
The ecosystem supporting this operation included an online marketplace called “W3LLSTORE.” Between 2019 and 2023, more than 25,000 compromised accounts were sold through this platform. Even after the marketplace shut down in 2023, the operation continued through encrypted messaging apps under a rebranded setup.
Between 2023 and 2024, the phishing kit targeted over 17,000 victims globally. On April 10, the alleged developer, identified as “G.L.,” was detained in Indonesia, and the infrastructure supporting the operation was seized. Authorities have not disclosed the full identity of the individual.
“This wasn’t just phishing—it was a full-service cybercrime platform,” said an official. “We will continue to work with our domestic and foreign law enforcement partners, using all available tools to protect the public.”
Key figures from the operation highlight its scale:
- $20 million in attempted fraud
- $500 cost to access the phishing kit
- 25,000 compromised accounts sold
- 17,000 victims targeted between 2023–2024
The takedown marks a significant step in disrupting global cybercrime networks. It is also the first coordinated action between these countries against a phishing kit developer. Authorities believe this action will cut off a major tool used by cybercriminals worldwide.
Also read: Viksit Workforce for a Viksit Bharat
Do Follow: The Mainstream LinkedIn | The Mainstream Facebook | The Mainstream Youtube | The Mainstream Twitter
About us:
The Mainstream is a premier platform delivering the latest updates and informed perspectives across the technology business and cyber landscape. Built on research-driven, thought leadership and original intellectual property, The Mainstream also curates summits & conferences that convene decision makers to explore how technology reshapes industries and leadership. With a growing presence in India and globally across the Middle East, Africa, ASEAN, the USA, the UK and Australia, The Mainstream carries a vision to bring the latest happenings and insights to 8.2 billion people and to place technology at the centre of conversation for leaders navigating the future.
