W3LL phishing service sold for $500 dismantled by the FBI
2026-04-14T14:51:52Z•50697dc27078a572ab80bef68b32d035adff615c7015cab310fc9286b3758d26
AI-fraudCPS-visibilityDavMailPII-exposureW3LLcredential-theftdata-breachexploit-mitigationfraudlaw-enforcement-takedownpatchphishingphishing-kitregex-vulnerabilityruntime-protection
What happened
Multiple security developments: The FBI, with Indonesian law enforcement, dismantled the W3LL phishing kit/service — a low-cost (~$500) phishing-as-a-service offering that enabled creation/deployment of near‑identical fake login pages to harvest credentials and was tied to more than $20M in attempted fraud. Other notable items: Basic‑Fit disclosed an internal-system breach impacting up to ~1 million members' personal data; Booking.com warned of unauthorized access to certain reservation information; DavMail 6.6.0 fixes a regex‑related security alert and adjusts Microsoft Graph/OAuth handling;/
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- helpnetsecurity
- Record identifier
- 50697dc27078a572ab80bef68b32d035adff615c7015cab310fc9286b3758d26
- Enrichment time
- 2026-04-14T14:51:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.