At the core of the operation was a tool known as the W3LL phishing kit—software that allowed attackers to create highly convincing fake login pages. Sold for around $500 through an underground marketplace called W3LLSTORE, it gave even low-skilled hackers access to advanced cyberattack capabilities.

What made the platform especially dangerous was its use of adversary-in-the-middle techniques. Instead of simply stealing passwords, attackers intercepted live login sessions, capturing authentication tokens in real time. This meant even accounts protected by multi-factor authentication could be compromised—a major escalation in phishing tactics.

Over time, the network scaled into a full “phishing-as-a-service” model, with around 500 threat actors involved and tens of thousands of stolen credentials traded. Even after shutdown attempts, operators adapted by moving to encrypted platforms, showing just how resilient and organized these cybercrime ecosystems have become.