FBI Atlanta, Indonesian authorities dismantle global phishing operation
Federal investigators in Atlanta say they've shut down a global cybercrime operation that used fake websites to steal thousands of usernames and passwords and fuel millions of dollars in fraud.
The FBI Atlanta Field Office announced the takedown as part of what officials called a first-of-its-kind joint investigation with Indonesian authorities.
At the center of the case was a phishing tool known as the "W3LL kit," which allowed cybercriminals to create fake login pages that looked nearly identical to trusted websites. Victims who entered their information unknowingly handed over access to their accounts.
Investigators say the tool went a step further by capturing session data, allowing hackers to bypass multi-factor authentication and stay logged in even after passwords were changed.
"This wasn't just phishing — it was a full-service cybercrime platform," FBI Atlanta Special Agent in Charge Marlo Graham said in a statement.
Authorities say the tool was sold for about $500 and supported by an online marketplace where criminals could buy and sell stolen credentials and access to compromised systems. Between 2019 and 2023, more than 25,000 accounts were sold through the platform.
Even after that marketplace shut down, officials say the operation continued through encrypted messaging apps, targeting more than 17,000 victims worldwide between 2023 and 2024. In total, the scheme is linked to attempts to steal more than $20 million.
With help from the U.S. Attorney's Office for the Northern District of Georgia and the Indonesian National Police, investigators identified and seized key parts of the operation's online infrastructure.
Authorities in Indonesia also detained the alleged developer behind the tool, identified as G.L.
Officials say shutting down the service cuts off a major resource used by cybercriminals around the world.
The FBI credited its international partners, calling the case a milestone in cross-border efforts to fight cybercrime and protect victims.
