Researchers Uncover Phishing Empire Attacking 56,000+ Microsoft 365 Accounts

Recent reports indicate that a new threat actor named “W3LL” has been discovered running a large phishing empire completely hidden until now. It was also found that this threat actor played a major role in compromising Microsoft 365 business email accounts over the past few years. 

Furthermore, the threat actor was also running a hidden underground market with the name “W3LL Store” that served a phishing kit called “W3LL panel” and 16 other fully customized tools that can be used for Business Email Compromise (BEC) Attacks.

Evolution of W3LL

As per the reports shared with Cyber Security News, this cybercriminal actor has been active since 2017, when they built their first tool, W3LL SMTP Sender, which was used for bulk email spam. They further developed their version of the phishing kit for targeting corporate Microsoft 365 accounts and opened their own Marketplace W3LL Store in 2018.

W3LL stores have been reported to have more than 500 active users with more than 3800 items sold, and their revenue is estimated to be half a million dollars over the past 10 months.

Phishing Kit subscription – $500

W3LL Panel is their greatest tool that has one of the most advanced phishing kits in class, which also features adversary-in-the-middle functionality, API, source code protection, and other unique capabilities.

Many sophisticated threat actors currently use a three-month phishing kit subscription for $500 due to its high efficiency. Every copy of the W3LL Panel must be enabled via token-based authentication to prevent reselling and source code stealing.

More than 850 unique websites were found to be attributed to the W3LL Panel, and threat actors used this tool to initiate a Business Email Compromise Attack with over 56,000 corporate Microsoft 365 business accounts, and more than 8,000 (about 14.3%) of them ultimately compromised.

“W3LL regularly updates its tools, adding new functionalities, improving anti-detection mechanisms, and creating new ones, which underlines the importance of staying up-to-date with the most recent changes in their TTPs.” reads the post by Group-IB.

Group IB has published a complete report about this threat actor, providing detailed information about the tools being sold, indicators of compromise, Geography of operations, and much more.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.