Global Phishing Operation Dismantled by FBI and Indonesian Authorities

Cybercriminals used fake websites to steal thousands of usernames and passwords, fueling millions in fraud.

Apr. 13, 2026 at 4:33pm

Got story updates? Submit your updates here. ›

An extreme close-up photograph of a cracked and shattered computer key, dramatically lit by a harsh flash against a dark background, conceptually representing the damage caused by a global phishing operation.The dismantling of a sophisticated phishing platform used by cybercriminals worldwide to steal millions exposes the growing threat of global cybercrime.Atlanta Today

Federal investigators in Atlanta have shut down a global cybercrime operation that used a sophisticated phishing tool called the 'W3LL kit' to create fake login pages and steal thousands of usernames and passwords, fueling millions of dollars in fraud. The joint investigation with Indonesian authorities led to the detention of the alleged developer behind the tool and the seizure of key parts of the operation's online infrastructure.

Why it matters

This case highlights the growing threat of global cybercrime networks that leverage advanced tools to bypass security measures and compromise a massive number of victims. The collaboration between U.S. and Indonesian authorities demonstrates the importance of international cooperation in disrupting these large-scale criminal enterprises.

The details

The 'W3LL kit' allowed cybercriminals to create fake login pages that closely resembled trusted websites, tricking victims into handing over their login credentials. The tool also captured session data, enabling hackers to bypass multi-factor authentication and maintain access even after passwords were changed. Between 2019 and 2024, the operation is linked to attempts to steal more than $20 million from over 17,000 victims worldwide.

  • The 'W3LL kit' was in use between 2019 and 2023.
  • The operation continued through encrypted messaging apps from 2023 to 2024.

The players

FBI Atlanta Field Office

The FBI's Atlanta Field Office led the investigation, working with the U.S. Attorney's Office for the Northern District of Georgia and the Indonesian National Police.

G.L.

The alleged developer of the 'W3LL kit' phishing tool, who was detained by Indonesian authorities.

Got photos? Submit your photos here. ›

What they’re saying

“This wasn't just phishing — it was a full-service cybercrime platform.”

— Marlo Graham, FBI Atlanta Special Agent in Charge

What’s next

Authorities in the U.S. and Indonesia will continue to investigate the global network of cybercriminals involved in the operation and pursue further legal action.

The takeaway

This case demonstrates the sophisticated tactics used by international cybercrime syndicates and the importance of cross-border collaboration to disrupt these large-scale criminal enterprises and protect victims worldwide.