Malaysian police in cooperation with the Australian Federal Police (AFP) and the US Federal Bureau of Investigation (FBI) dismantled a major phishing-as-a-service (PhaaS) operation called BulletProftLink (aka BulletProofLink and Anthrax).

Believed to be in operation since at least 2015, the platform provided a wide range of services at a relatively low cost, including more than 300 phishing templates mimicking known brands and services such as American Express, Bank of America, DHL, Microsoft, and Naver, phishing kits, email templates, hosting, and automated services. BulletProftLink is said to have amassed at least 8,000 customers.

The Malaysian authorities arrested 8 people aged between 29 and 56 across the country, including an alleged mastermind behind the operation. Alongside the arrests, the police confiscated servers, computers, jewelry, vehicles, and cryptocurrency wallets containing approximately 965,808 Malaysian ringgit (~$213,000).

On Tuesday, the US Department of Justice announced the takedown of the IPStorm malware botnet infrastructure, along with the guilty plea of the service’s operator Sergei Makinin.