FBI, Indonesian Police Disrupt Global Phishing Service After Arrest

Federal agents, working with Indonesian law enforcement, have taken offline an international online service accused of helping criminals impersonate legitimate websites and harvest account credentials from more than 17,000 people, the Justice Department said Monday. The site for the operation displayed a notice indicating it was under federal control.

Investigators say the platform, which went by the name W3LL, offered a ready-made fraud package that buyers could use to clone login pages for banks, email providers and other services. Authorities detained a person identified by the initials G.L. and confiscated several domains connected to the operation as part of the sweep.

The toolkit reportedly sold for about $500 and captured both passwords and two-step verification codes, enabling attackers to bypass common online protections. FBI officials linked the service to roughly $20 million in attempted scams and said its marketplace facilitated the trade of stolen logins, with about 25,000 compromised accounts sold through the platform.

Security specialists said the case underscores how inexpensive, turn-key crimeware lowers the barrier for would-be hackers. One analyst noted that when illicit tools are packaged and marketed like software, the number of potential attackers expands rapidly. Consumers and businesses are being urged to review account activity, enable stronger authentication methods and be wary of unsolicited login prompts.

The FBI did not offer an immediate additional statement when contacted for further details. Authorities said the investigation is ongoing and that cooperation with international partners will continue as they pursue others tied to the service.