Jakarta. The Indonesian Police, in coordination with the Federal Bureau of Investigation, have dismantled a cross-border cybercrime syndicate involved in selling phishing tools, arresting two suspects in Kupang, East Nusa Tenggara.

The suspects, identified by their initials GWL and FYTP, are believed to have generated up to Rp 25 billion ($1.5 million) in illicit proceeds from the operation.

The case came to light after a cybercrime unit detected a suspicious website offering phishing scripts. Investigators traced the activity to w3llstore.com, which was linked to the distribution of tools via Telegram bots, reinforcing suspicions of an organized marketplace for cybercrime tools.

“The tools obtained were proven to be usable for phishing activities, including stealing credentials and taking over victims’ accounts,” said National Police spokesperson Johnny Eddizon Isir on Wednesday.

According to authorities, the tools function by capturing data when victims enter their usernames and passwords, and can even extract active login sessions, enabling perpetrators to access accounts without requiring one-time password (OTP) verification.

The investigation also involved the FBI in identifying victims in the United States and tracing the broader user network of the tools.

“This shows that cybercrime has cross-border impacts. Police will continue to take firm action and strengthen international cooperation,” Johnny said.

GWL is suspected of developing and managing the phishing tools as well as their distribution channels, while FYTP allegedly handled the flow of proceeds through cryptocurrency and bank accounts. The syndicate reportedly shifted its transaction model from websites to Telegram, using crypto-based payments.

The suspects are believed to have operated between 2021 and 2025 before being arrested on April 9. Police have seized assets worth Rp 4.5 billion, including property, vehicles, and electronic devices.

Authorities said the investigation is ongoing, with efforts focused on identifying additional parties involved, including buyers and users of the phishing tools.

Johnny added that the crackdown sends a strong signal that Indonesia is not a safe haven for cybercriminals.

“This success further strengthens global confidence in Indonesia’s ability to maintain the stability and security of the international digital ecosystem,” he said.