NTT Couple Becomes Brains Behind International Phishing Operation Affecting 34,000 Victims, Arrested by FBI and Polri Together

Jakarta – The Cyber Crime Directorate (Dittipidsiber) of Bareskrim Polri, together with the FBI, has successfully dismantled a cross-border network providing phishing software (phishing tools). Two suspects, initialled GWL and FYTP, were arrested in Kupang, Nusa Tenggara Timur (NTT). Deputy Chief of Bareskrim Polri, Inspector General of Police Nunung Syaifudin, revealed that the case’s exposure marks one of the largest operations due to the global financial impact amounting to hundreds of billions of rupiah. “We have successfully uncovered an international phishing tools sales network. The suspects’ actions have caused global losses of around US$20 million, or approximately Rp350 billion,” he stated on Wednesday, 22 April 2026. The case came to light following a cyber patrol conducted by investigators. During the process, a website at www.3ll.cc was discovered, known for trading software used in illegal activities. “This case was uncovered starting from a cyber patrol that found the site www.3ll.cc, which trades in phishing tools,” he said. Investigators then conducted in-depth probing using undercover buy methods or covert purchases with cryptocurrency assets. This confirmed that the software was used for phishing activities or illegal access to personal data. The method involved the tool extracting victims’ data when entering usernames and passwords. It could even capture login sessions, allowing perpetrators to access accounts without needing OTP codes. Moreover, from the exposure, police identified thousands of buyers from various countries. “In this exposure, investigators successfully uncovered the international phishing tools sales network. Investigators also identified 2,440 buyers over the period from 2019 to 2024,” he said. From the investigation, approximately 34,000 people are suspected to have been victims globally. Police also seized evidence items and criminal proceeds worth billions of rupiah. “Other activities by investigators included seizing evidence and criminal assets valued at Rp4.5 billion,” he stated. In this case, the two suspects had different roles. GWL (24) acted as the main perpetrator who produced, sold, and developed the phishing tools independently since 2018. “The suspect’s background is a graduate of SMK Multimedia and acquired skills in creating scripts through self-study,” he said.