Cybercriminals allegedly used the W3LL phishing kit to target more than 17,000 v

The W3LL phishing kit has been a fixture of underground criminal markets for years, sold as a commercial product to other bad actors — a service model that should make anyone uncomfortable about what that level of professionalization implies. It began as a credential harvester, reasonably sophisticated by the standards of its time. It did not stay that way. By the time TechCrunch reported on it in April, W3LL had evolved into something that operates as a transparent proxy: inserting itself invisibly between a victim and the legitimate service they believe they're accessing. The user types their password. W3LL captures it. The user then provides their multi-factor authentication code. W3LL captures that too, relaying the session in real time so nothing appears to break. The alleged scale — more than 17,000 victims worldwide — suggests a coordinated campaign rather than opportunistic targeting. That distinction is worth holding onto.

If confirmed, here is what this means. The promise that MFA makes people meaningfully safer from phishing is not the promise it once was. W3LL-style adversary-in-the-middle attacks don't crack MFA; they route around it, treating the code as simply another input to harvest in the same moment the user surrenders it. For the tens of millions of people who adopted MFA specifically because they were told it was the reliable second line of defence, this is a structural problem, not a user-error problem. Organisations that built their security posture around MFA-as-sufficient will need to reckon with that. Passkeys and hardware security keys — which don't produce a code a proxy can intercept — move from "nice to have" to genuinely urgent. And the commercial model behind W3LL, where sophisticated attack infrastructure is rented rather than built, means the barrier to running a campaign at this scale continues to fall.

Watch for law enforcement action targeting W3LL's distribution network or associated infrastructure, and for any named victims or affected platforms that would let security researchers map the campaign's actual scope.

NewsHive monitors these sources continuously. All signal titles above link to the original reporting.

Intelligence by NewsHive. Need help navigating what this means for your business? Contact GeekyBee →