# W3LL Phishing-as-a-Service Ecosystem Dismantled — FBI/Indonesia Takedown of $20M BEC Platform

> The FBI and Indonesian National Police dismantled the W3LL phishing-as-a-service ecosystem, a 7-year criminal enterprise that sold a $500 AiTM phishing kit enabling 500+ cybercriminals to bypass MFA and compromise 25,000+ Microsoft 365 accounts, facilitating over $20 million in fraud attempts. The alleged developer 'G.L.' was arrested in Indonesia in the first coordinated US-Indonesia enforcement action against a phishing kit developer.

- **Published:** 2026-04-16T12:00:00Z
- **Last reviewed:** 2026-04-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0373
- **ID:** TL-2026-0373
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** MONITORING
- **Actor:** W3LL (Indonesia)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

W3LL was a sophisticated phishing-as-a-service (PhaaS) platform that operated from approximately 2017 through its takedown in April 2026. The ecosystem centered on the W3LL Panel OV6 — a fully automated adversary-in-the-middle (AiTM) phishing kit specifically designed to bypass multi-factor authentication on Microsoft 365 corporate accounts by intercepting session cookies during the authentication process.

The W3LL Store, an underground marketplace that operated from 2018 to 2023, served as the primary distribution channel. It sold the W3LL Panel kit for $500 per 3-month license ($150/month renewal) alongside 16+ additional tools covering the full BEC kill chain: OKELO (vulnerability scanner), CONTOOL (automated account discovery with email monitoring and Telegram notifications), W3LL Sender and PunnySender (SMTP bulk email tools), W3LL Redirect (malicious link staging), and LOMPAT (email validation). Revenue exceeded $500,000 between October 2022 and July 2023 alone, with 3,800+ items sold.

The AiTM attack chain operated by proxying the legitimate Microsoft 365 login portal through the W3LL Panel infrastructure. When victims clicked phishing links — typically disguised as Adobe Shared File pages (wfiles.html) — their browser communicated with the W3LL proxy server rather than directly with Microsoft. The kit intercepted credentials, one-time MFA passcodes, and most critically, authentication session cookies. These stolen session cookies allowed attackers to bypass MFA entirely, hijacking authenticated sessions without needing to re-authenticate. Anti-detection mechanisms included IonCube PHP encryption/obfuscation, Punycode encoding in email headers, HTML tag obfuscation, and multi-layer JavaScript encoding (base64) that loaded scripts directly from W3LL Panel infrastructure.

The infrastructure was identifiable by its characteristic /OV6 control panel path, heavily obfuscated PHP files, and credential exfiltration through wazzy.php endpoints. Stolen credentials were transmitted via Hastebin (file-sharing), Telegram bots, and email. The kit used valid Let's Encrypt TLS certificates to appear legitimate.

After the W3LL Store shut down in 2023, the operation continued through encrypted messaging platforms including Telegram, where the toolkit was rebranded and sold to new operators. The developer also secretly collected and resold access to compromised accounts — a double monetization scheme.

Code from W3LL OV6 was subsequently reused in the Sneaky 2FA phishing kit, identified by Sekoia in December 2024/January 2025, demonstrating the persistent influence of W3LL's codebase in the PhaaS ecosystem even after the marketplace closure.

The FBI Atlanta Field Office, in coordination with the Indonesian National Police, executed the takedown on April 13, 2026 — seizing infrastructure, key domains including w3ll.store, and arresting the alleged developer identified as 'G.L.' in Indonesia. Federal charges include conspiracy to commit wire fraud, computer fraud and abuse violations, and money laundering, carrying up to 20 years in federal prison. This represents the first coordinated US-Indonesia enforcement action against a phishing kit developer.

## MITRE ATT&CK

- T1566 Phishing
- T1204 User Execution
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1114 Email Collection
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1534 Internal Spearphishing
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1657 Financial Theft

## Sources

- [FBI Takedown of W3LL Phishing Service Leads to Developer Arrest](https://www.bleepingcomputer.com/news/security/fbi-takedown-of-w3ll-phishing-service-leads-to-developer-arrest/)
- [FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts](https://thehackernews.com/2026/04/fbi-and-indonesian-police-dismantle.html)
- [FBI Atlanta Takedown of W3LL Phishing Kit Linked to $20M](https://hoodline.com/2026/04/fbi-atlanta-crushes-w3ll-phishing-kit-tied-to-20-million-fraud-attempts/)
- [W3LL Phishing Service Sold for $500 Dismantled by the FBI](https://www.helpnetsecurity.com/2026/04/14/fbi-w3ll-phishing-kit-takedown/)
- [US, Indonesia Shut Down Sophisticated Phishing Kit](https://www.cybersecuritydive.com/news/phishing-kit-takedown-w3ll-us-indonesia/817318/)
- [W3LL Done: Hidden Phishing Ecosystem Driving BEC Attacks — Group-IB Original Report](https://www.group-ib.com/blog/w3ll-phishing-ecosystem/)
- [Group-IB W3LL Phishing Ecosystem Research Hub](https://www.group-ib.com/resources/research-hub/w3ll-phishing/)
- [One More Trip to The W3LL: Phishing Kit Targets Outlook Credentials — Hunt.io](https://hunt.io/blog/phishing-kit-targets-outlook-credentials)
- [Sneaky 2FA: Exposing a New AiTM Phishing-as-a-Service (W3LL Code Reuse) — Sekoia](https://blog.sekoia.io/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/)
- [W3LL Phishing Kit Hijacks Thousands of Microsoft 365 Accounts, Bypasses MFA](https://www.bleepingcomputer.com/news/security/w3ll-phishing-kit-hijacks-thousands-of-microsoft-365-accounts-bypasses-mfa/)
- [W3LL Phishing Kit Launches Active Campaign to Steal Outlook Login Credentials — GBHackers](https://gbhackers.com/w3ll-phishing-kit-launches-active-campaign/)
- [FBI Reveals Takedown of Notorious W3LL Phishing Operation — TechRadar](https://www.techradar.com/pro/security/this-wasnt-just-phishing-it-was-a-full-service-cybercrime-platform-fbi-reveals-takedown-of-notorious-w3ll-phishing-operation-targeting-thousands-of-victims)
- [FBI Announces Takedown of Phishing Operation That Targeted Thousands — TechCrunch](https://techcrunch.com/2026/04/13/fbi-announces-takedown-of-phishing-operation-that-targeted-thousands-of-victims/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0373