Expand / Collapse search
☰

FBI Atlanta takes down global $20M phishing network

By FOX 5 Atlanta Digital Team
Published  April 10, 2026 9:39pm EDT
Data Breaches
FOX 5 Atlanta

The Brief

    • The FBI Atlanta Field Office and Indonesian authorities took down a phishing network that attempted over $20 million in fraud. 
    • The operation used a "full-service" kit to steal usernames and bypass security on thousands of accounts worldwide. 
    • Police in Indonesia detained the alleged developer and seized domains used to sell stolen data to other criminals. 

ATLANTA - The FBI Atlanta Field Office and Indonesian law enforcement authorities dismantled a sophisticated global phishing operation that enabled cybercriminals to steal thousands of victims’ account credentials and attempt more than $20 million in fraud. 

Cybercrime platform fueled millions in fraud

What we know:

The operation centered on a tool called the "W3LL phishing kit." This cybercrime platform allowed criminals to impersonate legitimate login pages to trick victims into handing over their usernames and passwords. For a fee of about $500, users could purchase access to the kit and deploy fake websites designed to look nearly identical to trusted portals. 

The tool was supported by an online marketplace called "W3LLSTORE." Between 2019 and 2023, the marketplace facilitated the sale of more than 25,000 compromised accounts. Even after the store shut down in 2023, the operation continued through encrypted messaging apps where the tool was rebranded. 

What we don't know:

Authorities have not released the full name of the alleged developer, identifying them only as G.L. It is also unclear how many individual victims in Georgia were specifically targeted by the 17,000 global phishing attempts recorded between 2023 and 2024. 

FBI and Indonesia take down phishing developer

Timeline:

  • 2019–2023: The W3LLSTORE marketplace facilitates the sale of more than 25,000 compromised accounts. 
  • 2023: The W3LLSTORE marketplace shuts down, but the operation moves to encrypted messaging platforms. 
  • 2023–2024: The phishing kit is used to target more than 17,000 victims worldwide. 
  • April 10, 2026: FBI Atlanta and Indonesian National Police announce the seizure of infrastructure and the detention of the developer. 

What they're saying:

"This wasn’t just phishing—it was a full-service cybercrime platform," said FBI Atlanta Special Agent in Charge Marlo Graham. "We will continue to work with our domestic and foreign law enforcement partners, using all available tools to protect the public." 

By the numbers:

  • $20 million: The amount of fraud attempts linked to the network. 
  • $500: The cost for a criminal to purchase access to the phishing kit. 
  • 25,000: The number of compromised accounts sold through the W3LLSTORE marketplace.  
  • 17,000: The number of victims targeted worldwide between 2023 and 2024. 

What's next:

The takedown cuts off a major resource used by cybercriminals. The FBI Atlanta Field Office noted that this case represents the first coordinated action against a phishing kit developer between the United States and Indonesia. 

The Source: The information in this story was gathered from the FBI Atlanta Field Office and the U.S. Attorney’s Office for the Northern District of Georgia. 

Data BreachesNewsCrime and Public SafetyAtlanta