Roles of Two Suspects in Transnational Phishing Tools Syndicate Uncovered by Bareskrim

The Bareskrim Polri team has arrested two individuals with the initials GWL and FYTP who were involved in an online fraud syndicate or phishing operation using fake tools that operates across countries. The two suspects have different roles. According to a written statement from Mabes Polri on Thursday (16/4/2026), the two suspects were secured by police in Kupang, East Nusa Tenggara (NTT). GWL is known to act as the creator and manager of the tools and distribution channels. Meanwhile, FYTP plays the role of managing the flow of funds from the crimes through crypto and bank accounts. The uncovering of this case began with cyber patrols by the Bareskrim Polri team, which found a suspicious site selling phishing scripts. The investigation continued until it led to the w3llstore.com platform, which is connected to the distribution of tools via Telegram bots. “As a result, the tools obtained were proven to be usable for phishing actions, including stealing credentials and taking over victims’ accounts,” said Polri’s Head of Public Relations Division, Inspector General Johnny Eddizon Isir, in his statement on Wednesday (15/4/2026). Johnny explained that these tools work by siphoning data when victims enter their username and password. In fact, according to him, the tools are capable of capturing login sessions so that the perpetrators can access accounts without needing OTP codes. The uncovering of this case also involved cooperation with the Federal Bureau of Investigation (FBI) to identify victims in the United States and trace the network of tool users. Victims are known not only from within the country but also from abroad. Johnny added that the transaction method has shifted from websites to Telegram with crypto-based payments. From transaction tracing since 2021 to 2026, the two suspects are estimated to have reaped profits of up to Rp 25 billion. Police also seized assets worth around Rp 4.5 billion in the form of houses, vehicles, and electronic goods. Johnny emphasised that this uncovering is part of Polri’s commitment to maintaining digital space security. “This shows that cybercrime has broad and cross-border impacts. Polri will continue to crack down firmly and strengthen international cooperation,” he said. He emphasised that his side will continue to take action against cybercrime. Investigators are currently still developing the case to trace other involved parties, including buyers and users of the phishing tools. “This success also strengthens global trust in Indonesia in maintaining the stability and security of the international digital ecosystem,” he concluded.