The Federal Bureau of Investigation and Indonesian police have dismantled the W3LL phishing network, seizing infrastructure linked to more than $20 million in fraud attempts.
Authorities said the operation targeted a phishing-as-a-service platform that enabled hackers to create fake login pages and bypass multi-factor authentication, affecting more than 17,000 victims globally.
The joint probe led to the arrest of alleged developer G.L. in Indonesia, marking the first coordinated cybercrime takedown between the US and Indonesia.
The W3LL platform sold access to attackers for around $500 via an underground marketplace known as W3LLSTORE, with roughly 500 threat actors using the tools to steal credentials.
Investigators said the kit used adversary-in-the-middle techniques to intercept login sessions in real time, capturing authentication tokens and passwords even from protected accounts.
Between 2019 and 2023, more than 25,000 stolen credentials were traded through the platform, with operators later shifting to encrypted messaging apps after the marketplace shut down.
The takedown comes as phishing attacks continue to target digital asset users, with crypto investors losing more than $300 million to phishing scams in January 2026 alone.