Ankura CTIX FLASH Update - September 8, 2023

Malware Activity

New Phishing Tool "W3LL Panel" Observed Compromising Thousands of Microsoft 365 Accounts

Researchers have uncovered a covert business email compromise (BEC) "phishing empire" targeting Microsoft 365 accounts throughout the United States, Europe, and Australia with a new phishing kit. W3LL, the threat actor behind the phishing empire, has been noted as playing a major role in Microsoft 365 BECs over the last six (6) years. Researchers explained that W3LL has a hidden, English-speaking underground market called "W3LL Store" that "served a closed community of at least 500 threat actors who could purchase a custom phishing kit called W3LL Panel, designed to bypass MFA, as well as 16 other fully customized tools for business email compromise (BEC) attacks." The phishing tools have been reported to have collectively targeted approximately 56,000 corporate M365 accounts between October 2022 and July 2023, with an estimated turnover of roughly $500,000,