Global Phishing Operation Dismantled by FBI, International Police

Cybercrime tool allowed criminals to steal credentials and bypass multi-factor authentication

Apr. 13, 2026 at 7:09pm

Got story updates? Submit your updates here. ›

An extreme close-up photograph of a computer keyboard with several keys removed, lit by a harsh, direct camera flash against a pitch-black background, conceptually representing the intrusive nature of cybercrime.A joint investigation by U.S. and international law enforcement agencies has dismantled a global phishing operation that stole millions from victims worldwide.Atlanta Today

In a joint cyber investigation, the FBI Atlanta Field Office and Indonesian authorities have dismantled a global phishing operation tied to more than $20 million in attempted fraud. The operation centered on the W3LL phishing kit, a cybercrime tool that allowed users to create fake login pages designed to steal credentials from victims. The tool was supported by an online marketplace known as W3LLSTORE, where criminals bought and sold stolen credentials and unauthorized system access.

Why it matters

This case highlights the growing threat of global cybercrime operations that leverage sophisticated tools to steal personal and financial data on a massive scale. The collaboration between U.S. and international law enforcement agencies demonstrates the coordinated effort required to dismantle these complex, cross-border schemes.

The details

For about $500, users could purchase access to the W3LL phishing kit and deploy counterfeit websites that closely mimicked legitimate login portals. Once victims entered their information, the tool captured usernames, passwords, and session data, allowing criminals to bypass multi-factor authentication and maintain access to accounts. The W3LLSTORE marketplace facilitated the sale of more than 25,000 compromised accounts between 2019 and 2023. Even after W3LLSTORE shut down in 2023, the operation continued through encrypted messaging platforms, where the tool was rebranded and marketed to cybercriminals.

  • From 2019 to 2023, the W3LLSTORE marketplace facilitated the sale of more than 25,000 compromised accounts.
  • In 2023, W3LLSTORE shut down, but the operation continued through encrypted messaging platforms until 2024.

The players

FBI Atlanta Field Office

The FBI's Atlanta field office, which helped lead the joint investigation and dismantle the global phishing operation.

Indonesian Authorities

International law enforcement agencies, including Indonesian authorities, that collaborated with the FBI in the investigation.

G.L.

The alleged developer of the W3LL phishing kit, who was detained by authorities.

Got photos? Submit your photos here. ›

What they’re saying

“This wasn't just phishing, it was a full-service cybercrime platform. We will continue to work with our domestic and foreign law enforcement partners, using all available tools to protect the public.”

— Marlo Graham, FBI Atlanta Special Agent in Charge

What’s next

Authorities are continuing to investigate the full scope of the phishing operation and any additional individuals involved.

The takeaway

This case demonstrates the growing sophistication and global reach of cybercrime operations, as well as the importance of international law enforcement cooperation in dismantling these complex schemes that target victims worldwide.