Interpol shutters Indonesia-based “phishing-as-a-service” platform 16shop, used to create 150K phishing pages, compromising at least 70K people in 43 countries
A joint operation between Interpol and cybersecurity firms has led to an arrest and shutdown of the notorious 16shop phishing-as-a-service (PhaaS) platform.
Context & Ripple Effects
This operation extends Interpol’s cross-border enforcement record, including its earlier removal of roughly 113,000 fake-pharmacy links, but targets a service layer that enabled other actors to launch credential-theft campaigns at scale.
Later disruptions of the LabHost phishing-service operation and Tycoon2FA show that 16shop was part of a recurring enforcement focus on phishing-as-a-service infrastructure rather than only individual fraudulent sites.
First-order effects
- 16shop’s arrest and shutdown remove a ready-made phishing-page creation service from its operators and customers, interrupting campaigns built through that platform.
- The joint action gives Interpol and participating cybersecurity firms an operational result against infrastructure associated with 150,000 phishing pages and at least 70,000 compromised people.
Second-order effects
- Other phishing-as-a-service operators face greater exposure when platform operators, rather than only hosted pages, become the target of coordinated investigations.
- Customers dependent on a centralized phishing toolkit must replace or rebuild that capability, while defenders can use intelligence from the disruption to identify related campaigns and infrastructure.
Third-order effects
- Repeated actions against services such as Tycoon2FA point to phishing enforcement moving upstream toward criminal enablement platforms, where one intervention can affect many downstream campaigns.
- If international coordination and private-sector participation remain sustained, phishing-as-a-service may become more fragmented and operationally costly; takedowns alone are unlikely to eliminate demand for such tools.
The trend: Cross-border cybercrime enforcement is increasingly targeting the shared platforms that industrialize phishing, not just the individual pages they produce.