US and Indonesia bust W3LL phishing ring behind $20M fraud

US and Indonesian law enforcement authorities have dismantled a large-scale phishing network that has plotted over $20 million in fraud, led by the FBI Atlanta field office. The operation revolved around W3LL, a phishing kit that enables impersonation of legitimate login pages and theft of usernames and passwords, with kit access reportedly priced at $500.

The kit was sold on W3LL Store, a members-only marketplace active between 2019 and 2023, which investigators say facilitated the sale of more than 25,000 compromised accounts until its closure in 2023, according to Fox 5 Atlanta. After the marketplace shut, the phishing operation continued via encrypted messaging apps, and between 2023 and 2025 W3LL may have targeted more than 17,000 victims worldwide.

The FBI said it has seized the w3ll[.]store domain and identified its alleged developer, publicly referred to as ‘G.L.’, with the operation first discovered in 2023 by Group-IB.