FBI, Indonesia dismantle global phishing network behind US$20m fraud attempts

A joint investigation between the Federal Bureau of Investigation Atlanta Field Office and the Indonesian National Police has dismantled a global phishing operation that enabled cybercriminals to attempt more than US$20 million in fraud, in what authorities describe as a first-of-its-kind collaboration between the two countries.

At the centre of the operation was the W3LL phishing kit, a sophisticated cybercrime tool that enabled bad actors to replicate legitimate login pages and harvest users’ credentials at scale. Sold for approximately US$500, the kit lowered the barrier to entry for cybercriminals, allowing them to deploy convincing fake portals mimicking trusted platforms.

Once victims entered their login details, the tool captured not only usernames and passwords but also session data, enabling attackers to bypass multi-factor authentication and maintain persistent access to compromised accounts.

Don't miss: Study: SG, ID most on edge as AI-powered phishing shakes global trust

“This wasn’t just phishing – it was a full-service cybercrime platform,” said FBI Atlanta special agent in charge Marlo Graham. “We will continue to work with our domestic and foreign law enforcement partners, using all available tools to protect the public.”

The phishing infrastructure was further supported by W3LLSTORE, an online marketplace where cybercriminals could trade stolen credentials and unauthorised system access, including remote desktop connections. Between 2019 and 2023, more than 25,000 compromised accounts were sold through the platform.

Although W3LLSTORE ceased operations in 2023, investigators found that the network persisted via encrypted messaging platforms, where the phishing kit was rebranded and actively promoted. From 2023 to 2024 alone, it was used in attacks targeting more than 17,000 victims globally.

Authorities also uncovered that the developer behind the tool played an active role in monetising the ecosystem, collecting and reselling access to compromised accounts, thereby amplifying the scale and impact of the scheme.

Through the investigation, the FBI Atlanta Field Office, with support from the US Attorney’s Office for the Northern District of Georgia, identified and seized key infrastructure linked to the phishing service. In coordination with Indonesian authorities, law enforcement detained the alleged developer, identified as G.L., and took control of domains associated with the operation.

The takedown is expected to significantly disrupt a major enabler of cybercrime, cutting off a widely used resource for gaining unauthorised access to personal and corporate accounts.

For marketers and brand custodians, the case underscores the growing sophistication of phishing threats and the reputational risks tied to impersonation attacks. As phishing kits increasingly mimic brand-owned digital touchpoints with precision, safeguarding customer trust now requires closer collaboration between cybersecurity teams, regulators and platform providers.

The FBI Atlanta Field Office credited the Indonesian National Police for its critical role in the investigation, noting that the case marks the first coordinated enforcement action targeting a phishing kit developer between the US and Indonesia.

Be part of PR Asia Indonesia 2026 on 15 July 2026 – the first time this regional communications flagship lands in Jakarta – bringing together communications leaders ready to redefine influence, reputation, and impact!

Related articles:
HKMA alerts public to alleged phishing Telegram group related to Bank of Singapore
How media and public perceptions around cybersecurity are evolving in Southeast Asia
Study: 71% of companies fall into low categories of cybersecurity readiness