{"id":45337,"date":"2026-04-12T23:57:04","date_gmt":"2026-04-12T15:57:04","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/12\/fbi-atlanta-and-indonesian-national-police-take-down-w3llstore-phishing-marketplace\/"},"modified":"2026-04-12T23:57:04","modified_gmt":"2026-04-12T15:57:04","slug":"fbi-atlanta-and-indonesian-national-police-take-down-w3llstore-phishing-marketplace","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/12\/fbi-atlanta-and-indonesian-national-police-take-down-w3llstore-phishing-marketplace\/","title":{"rendered":"FBI Atlanta and Indonesian National Police Take Down W3LLSTORE Phishing Marketplace"},"content":{"rendered":"\n

The FBI Atlanta Field Office and the Indonesian National Police have taken down a global phishing operation<\/a> tied to more than $20 million in attempted fraud, according to authorities. The action included infrastructure seizures and the detention of a suspected developer linked to a widely used phishing kit.<\/p>\n

Investigators say the operation was built around a tool known as the W3LL phishing kit, which allowed cybercriminals to create convincing replicas of legitimate login pages. The service was sold for about $500, providing buyers with a ready-to-use method to steal usernames and passwords from targeted victims.<\/p>\n

W3LLSTORE<\/strong><\/h3>\n

Authorities describe the operation as a full-service cybercrime platform rather than a single tool. The kit was supported by an online marketplace called W3LLSTORE, where stolen credentials were bought and sold. Between 2019 and 2023, the marketplace facilitated the sale of more than 25,000 compromised accounts.<\/p>\n

After W3LLSTORE shut down in 2023, the operation continued through encrypted messaging platforms. Law enforcement says the service was rebranded and distributed privately, allowing it to remain active and reach new users despite the closure of its public marketplace.<\/p>\n

From 2023 to 2024, the phishing kit was used in more than 17,000 attacks worldwide. Group-IB’s findings<\/a> in September 2023 linked the platform to campaigns targeting corporate environments, including Microsoft 365 accounts, in which attackers attempted to bypass authentication protections and gain persistent access. <\/p>\n

Worldwide Victims<\/strong><\/h3>\n

According to Group-IB, activity was heavily concentrated in a few key countries while still reaching targets worldwide, with the United States accounting for more than half of the identified cases. <\/p>\n

At the same time, the attacks targeted multiple industries, with manufacturing, technology, and professional services among the most affected. Here\u2019s a breakdown of the countries targeted by the W3LL phishing kit powered by W3LLSTORE marketplace, based on data from Group-IB:<\/p>\n