John Z Black
Brunswick, ME • (207) 245-1010 • contact@johnzblack.com
FBI Atlanta and Indonesian National Police took down W3LL, a phishing-as-a-service platform running since at least 2019. The website now shows a seizure banner. The developer, identified publicly only as G.L., was detained in Indonesia.
That’s the news. Here’s what actually matters.
This is the third major PhaaS or cybercrime platform the FBI has dismantled in 2026. Leakbase first. Then RAMP. Now W3LL. Add the December arrest of the RaccoonO365 developer with help from Nigerian police, and you’ve got a pattern. The FBI is running a coordinated campaign against phishing infrastructure, with functioning international law enforcement partnerships to back it up.
W3LL wasn’t a casual toolkit. The platform marketed access to more than 25,000 compromised accounts. A 2023-2024 campaign tied to the infrastructure hit some 17,000 victims. Group-IB found the tools were used to target over 56,000 corporate Microsoft 365 accounts across the U.S., UK, Australia, and Europe in less than a year. And it was explicitly built to bypass MFA, using adversary-in-the-middle infrastructure that intercepts session tokens. That’s not credential stuffing. That’s a different capability level entirely.
The reconstitution problem is real. W3LLSTORE, the original marketplace, was actually shut down in 2023. The ecosystem didn’t die. It migrated to encrypted channels and kept operating. Criminal communities don’t disappear when one provider gets taken down. They move. What takedowns accomplish is imposing costs: forcing rebuilds, disrupting trust networks, and occasionally, as here, putting the actual architect in custody rather than just seizing a server.
Developer detention is a meaningful escalation. Hard to reconstitute an operation when the person who built it is unavailable.
For defenders: standard MFA won’t stop adversary-in-the-middle phishing. FIDO2/passkeys will. If your high-value accounts are still on TOTP or SMS codes, that’s the specific gap W3LL’s customers were exploiting. Impossible-travel detection and mailbox rule monitoring catch the next steps after a session token is stolen.