INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Phishing Operation Targets Millions via Zero-Day Exploit

| 2026-04-13 10:35 LOW MEDIUM
JSON
Executive Summary AI-generated
The US and Indonesian law enforcement authorities have taken down a large-scale phishing network that has plotted over $20 million in fraud. The operation, dubbed W3LL, was spearheaded by the FBI Atlanta field office and targeted a phishing kit known as W3LL.store, which enabled cybercriminals to impersonate legitimate login pages and trick victims into handing over their usernames and passwords. The FBI seized the w3ll.store domain and identified its alleged developer, publicly referred to as 'G.L.', who had been operating since at least 2017. Researchers from cybersecurity firm Group-IB had previously reported that the threat actor behind W3LL had been in operation for several years, selling a custom tool called the W3LL SMTP Sender - a key component of the phishing kit. The malicious actor later started selling a phishing kit for Microsoft 365 accounts and opened the W3LL Store marketplace, which was active between 2019 and 2023. This complex phishing ecosystem had linked to over 850 phishing sites during the same period, making it stand out from other underground markets.
Technical Mitigations AI-generated
• Implement robust security measures to prevent phishing kits from being sold on members-only online marketplaces, such as W3LL Store. • Regularly monitor and audit third-party vendors and platforms for potential vulnerabilities or suspicious activity that could be exploited by cybercriminals. • Develop and enforce strict policies and procedures for identifying and reporting suspected phishing operations, including the use of AI-powered tools to detect malicious emails.
Technical Observables
w3ll.store
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Operation W3LLOperation W3LL
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎at least 2017
Threat actors used a custom SMTP sender tool, W3LL, to target victims since at least 2017.
tactic Phishing
In a September 2023 report , the firm’s researchers claimed the threat actor behind the phishing operation had been operating since at least 2017, when it began selling the W3LL SMTP Sender – a custom tool for sending email spam.
‎September 2023
Phishing actors used the W3LL Store to target Microsoft 365 users, selling a phishing kit that was linked to over 850 compromised websites.
tactic Phishing
In a September 2023 report , the firm’s researchers claimed the threat actor behind the phishing operation had been operating since at least 2017, when it began selling the W3LL SMTP Sender – a custom tool for sending email spam.
infrastructure Microsoft 365
The malicious actor later started selling a phishing kit for Microsoft 365 accounts and subsequently opened the W3LL Store.
organisation Microsoft
The malicious actor later started selling a phishing kit for Microsoft 365 accounts and subsequently opened the W3LL Store.
organisation Group-IB
Group-IB noted that what made the W3LL Store and its products stand out from other underground markets is that the threat actor created not just a marketplace but a complex phishing ecosystem .
organisation Group
At the time the report was published, Group-IB observed that that the marketplace had over 500 active users and more than 12,000 items listed for sale.
victims 500 active users
At the time the report was published, Group-IB observed that that the marketplace had over 500 active users and more than 12,000 items listed for sale.
organisation the W3LL Store
Researchers estimated the W3LL Store had generated $500,000 for the actor over a 10-month period.
financial $500,000 Store
Researchers estimated the W3LL Store had generated $500,000 for the actor over a 10-month period.
‎between 2019 and 2023
Threat actors used the FBI Disrupt & Debrief tool to target and dismantle a $20m phishing operation on W3LL Store, an online marketplace active between 2019 and 2023.
‎Between 2023 and 2025
Threat actors used the FBI's W3LL tool to target approximately 17,000 victims worldwide between 2023 and 2025.
victims 17,000 victims
Between 2023 and 2025, W3LL may have been used to target more than 17,000 victims worldwide.
‎2026/04/13
The FBI dismantled a $20m phishing operation called W3LL, which was facilitated by the marketplace and targeted over 25,000 compromised accounts.
financial $20 network
US and Indonesian law enforcement authorities have taken down a large-scale phishing network that has plotted over $20 million in fraud.
FBI Dismantles $20m Phishing Operation W3LL.
organisation Fox 5 Atlanta
According to Fox 5 Atlanta , investigators believe the marketplace facilitated the sale of more than 25,000 compromised accounts until its closure in 2023.
Tactical Metrics
Metrics
financial
20,000,000
Network
US and Indonesian law enforcement authorities have taken down a large-scale phishing network that has plotted over $20 million in fraud.
FBI Dismantles $20m Phishing Operation W3LL.
Metrics
infrastructure
‎Microsoft 365
Affected Product
The malicious actor later started selling a phishing kit for Microsoft 365 accounts and subsequently opened the W3LL Store.
Metrics
victims
17,000
Victims
Between 2023 and 2025, W3LL may have been used to target more than 17,000 victims worldwide.
Metrics
victims
500
Active Users
At the time the report was published, Group-IB observed that that the marketplace had over 500 active users and more than 12,000 items listed for sale.
Metrics
financial
500,000
Store
Researchers estimated the W3LL Store had generated $500,000 for the actor over a 10-month period.
Intelligence Sources
Infosecurity-Magazine 2026-04-13
Infosecurity-Magazine 2026-04-13