Widely attributedUnknown
W3LL
Prolific phishing-as-a-service operator selling the W3LL Panel toolkit targeting Microsoft 365 accounts. Responsible for thousands of business email compromise attacks globally.
Attribution signal
?Score = mentions × confidence weight, summed across all attributed sources. Higher source diversity increases the score.≥ 10 High≥ 3 Moderate< 3 Low0.8
Low signal strength
Mentions1
Sources0
High conf.1
Last seenMay 2026
First observed
—
Last active
—
Origin
—
Aliases
1
Techniques
0
Campaigns
0
TargetsTechnologyFinancial
RegionsGlobal
Attribution signals
1 mention · 0 sources#1high
InfrastructureMalware
groupib
May 2026