🧠 Food for thought

Implications, context, and why it matters.

W3LL ran like a small software company

• W3LL sold phishing-as-a-service (PhaaS) through a platform that ran like a real software shop 1.
• Access came through a private, referral-only market. It offered 16 tools, a help-ticket support desk, and training videos plus a reseller program 2.
• Group-IB, a cybersecurity company, said W3LL Panel cost US$500 for an initial three-month subscription. It used token-based licensing to block unauthorized resale 2.
• The kit used an adversary-in-the-middle (AiTM) technique. It sits between a victim and services such as Microsoft 365, then captures credentials plus session tokens that can bypass multi-factor authentication (MFA) 3.

The takedown tracks a larger change in cybercrime

• Taking W3LL offline disrupts one crew, while the wider phishing-as-a-service market keeps running 4.
• W3LLSTORE closed in 2023. Sales kept going on encrypted messaging platforms, with the toolkit rebranded and resold 5.
• AiTM is no longer rare. Similar kits now serve profit-driven criminals and nation-state actors tied to Russia 4.
• Wider use can weaken MFA on its own. Security teams may move to phishing-resistant options and tighter session monitoring 4.