Home / Crime and Justice / W3LL Phishing Tool Disrupted: $20M Stolen, 42K Accounts Hit
W3LL Phishing Tool Disrupted: $20M Stolen, 42K Accounts Hit
14 Apr
Summary
- W3LL phishing kit helped criminals steal account credentials.
- The FBI and Indonesian National Police dismantled key infrastructure.
- Estimated $20 million was stolen through compromised accounts.
A significant blow has been dealt to cybercrime with the takedown of infrastructure vital to the W3LL phishing kit. This tool, operational from 2019 until its marketplace closure in 2023, was instrumental in stealing tens of thousands of account credentials, with a primary focus on Microsoft 365 accounts.
The FBI and Indonesian National Police collaborated to dismantle the core components of the W3LL operation. Cybercriminals purchased the kit for approximately $500 and utilized it to deploy fake websites capturing login information and session data, effectively bypassing multi-factor authentication. This sophisticated platform offered customer service, tutorials, and even affiliate programs.
Group-IB, a cybersecurity firm, first documented the W3LL kit in 2023, describing it as a comprehensive cybercrime service. The developer, known as G.L., was reportedly detained by authorities. The FBI estimates that the W3LL store listed over 25,000 compromised accounts, with an additional 17,000 accounts compromised in 2023 and 2024, leading to an estimated $20 million in attempted theft.
While the main W3LL kit has been disrupted, concerns remain about its legacy. Similar tools using W3LL source code have been identified, and cracked versions have circulated for years, suggesting the threat may not be entirely eradicated.
