Indonesian Police Uncover Cross-Border Phishing Tool Syndicate, Collaborate with FBI to Trace US Victims

Jakarta - Bareskrim Polri has uncovered a cross-border syndicate selling phishing tools, suspected of reaping profits of up to Rp 25 billion. In this revelation, Polri is collaborating with the Federal Bureau of Investigation (FBI) to trace victims and the perpetrators’ networks abroad, particularly in the United States. “This demonstrates that cybercrime has widespread and cross-border impacts. Polri will continue to crack down firmly and strengthen international cooperation,” said Head of the Polri Public Relations Division, Inspector General Johnny Eddizon Isir, in his statement on Wednesday (15/4/2026). Two suspects with initials GWL and FYTP were arrested in Kupang, East Nusa Tenggara, on Thursday (9/4/2026). Isir explained that the case’s discovery stemmed from a cyber patrol that found a suspicious site selling phishing scripts. The subsequent investigation led to the platform w3llstore.com, which is linked to the distribution of tools via Telegram bots. “The results showed that the obtained tools can indeed be used for phishing actions, including stealing credentials and taking over victims’ accounts,” he said. He further stated that the tools operate by siphoning victims’ data when they enter their usernames and passwords. Moreover, the software is capable of capturing login sessions, allowing perpetrators to access victims’ accounts without needing the one-time password (OTP) code. Based on the investigation results, GWL played the role of both creator and manager of the tools, as well as the distribution channels. The syndicate’s modus operandi has also shifted. Previously, transactions were conducted via websites, but now they have moved to the Telegram platform with crypto-based payment systems to evade tracking. The police revealed that victims are not only from Indonesia but also from abroad.