FBI, Indonesian Police Take Down W3LL Phishing Operation Tied to $20M in Fraud

A joint operation between the FBI and Indonesian National Police has dismantled the W3LL phishing network, a sophisticated phishing-as-a-service operation responsible for an estimated $20 million in fraud attempts. W3LL had previously been identified as a major supplier of phishing toolkits designed to bypass multi-factor authentication and compromise Microsoft 365 business email accounts at scale.

The takedown marks a significant law enforcement action against the commercialized phishing ecosystem, where operators like W3LL sell ready-made attack infrastructure to lower-skilled criminals. The network’s tools were notable for their effectiveness against enterprise targets, enabling business email compromise campaigns that could intercept MFA tokens and hijack authenticated sessions.

The cross-border collaboration between U.S. and Indonesian authorities underscores the increasingly international nature of cybercrime enforcement, as phishing operations distribute their infrastructure and personnel across jurisdictions to complicate takedown efforts.