Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA

In a significant blow to the global cybercrime ecosystem, a coordinated international effort spearheaded by German and US law enforcement agencies has successfully dismantled the core infrastructure of "Kratos," identified by German investigators as one of the world’s most pervasive criminal phishing kits. The operation, culminating in the arrest of the alleged developer in Indonesia, marks a critical step in combating sophisticated Phishing-as-a-Service (PhaaS) platforms that have enabled countless account takeovers and financial frauds worldwide.

The Anatomy of Kratos: A Sophisticated Phishing-as-a-Service Platform

Kratos, also tracked by Microsoft Threat Intelligence under the moniker "SneakyLog," was far more than a simple credential harvesting tool. German authorities, notably the Frankfurt public prosecutor’s cybercrime unit (ZIT) and Germany’s Federal Criminal Police Office (BKA), described it as a highly advanced phishing kit capable of executing Adversary-in-the-Middle (AiTM) attacks. This sophisticated technique allowed cybercriminals to bypass traditional multi-factor authentication (MFA) mechanisms, a critical defense layer for many organizations and individuals.

The kit’s sophistication lay in its dual operational modes, as detailed by cybersecurity firm ANY.RUN, which conducted an in-depth reverse-engineering analysis. One mode offered a straightforward PHP page designed to harvest only credentials, a common tactic for less complex phishing operations. The second, and far more dangerous, mode utilized a Node.js reverse proxy. This advanced setup was engineered to relay login attempts to legitimate services, such as Microsoft 365, in real-time. Crucially, while relaying the authentication, it simultaneously captured the resulting session cookie. This session cookie, once stolen, grants unauthorized access to a user’s account, effectively allowing the attacker to "walk past" even strong MFA implementations without needing the actual second factor. This capability transformed Kratos into a potent weapon, rendering conventional MFA a much weaker safeguard than many users and organizations perceived. The ability to intercept and leverage session cookies highlights the evolving landscape of cyber threats, where attackers are increasingly targeting authentication flows rather than just static credentials.

A Global Operation: Unraveling the Network

The takedown, publicly announced on Monday, July 22, 2026, by the ZIT and BKA, involved pulling more than 200 servers offline that were integral to Kratos’s operations. These servers formed the backbone of the PhaaS platform, hosting phishing pages, managing customer accounts, and facilitating the flow of stolen data. The sheer number of servers underscores the vast scale of the Kratos infrastructure, which spanned across various jurisdictions, making international collaboration indispensable for its disruption.

The collaborative efforts extended beyond Germany and the US. Indonesian authorities played a crucial role, executing the arrest of the individual believed to be the primary developer and operator of the Kratos platform. While specific details about the individual or the circumstances of the arrest were not immediately released, this apprehension represents a significant victory, targeting the very architect of this widespread criminal enterprise rather than just its users. The successful identification and apprehension of a key figure in such an intricate global operation demonstrate the growing capabilities of law enforcement agencies in tracking and prosecuting cybercriminals across borders.

Tracing the Digital Footprints: A Chronology of Detection

The Kratos kit did not emerge overnight; it had been actively tracked by cybersecurity researchers and threat intelligence organizations for some time. Microsoft Threat Intelligence, for instance, had been monitoring the kit, identifying it as "SneakyLog," and observed its deployment in credential and 2FA theft campaigns against Microsoft 365 users since at least early 2025. This long-term monitoring provided crucial insights into the kit’s functionalities, targets, and modus operandi, laying the groundwork for the eventual law enforcement action.

A notable instance of Kratos’s deployment was documented by Microsoft in February 2026. During this period, operators launched a targeted tax-themed phishing campaign, sending malicious emails to approximately 100 organizations, predominantly in the United States. These targets spanned critical sectors, including manufacturing, retail, and healthcare. The emails cleverly incorporated a W-2 document containing a personalized QR code for each recipient. Scanning this QR code redirected victims to a meticulously crafted, fake Microsoft 365 login page, designed to steal credentials and session cookies using Kratos’s AiTM capabilities. Such campaigns highlight the opportunistic nature of cybercriminals, often leveraging seasonal themes like tax season to enhance the credibility of their social engineering tactics.

ANY.RUN’s reverse-engineering efforts further illuminated the kit’s operational footprint. Their analysis revealed a distinct "tell" for Kratos-powered login pages: they almost invariably loaded specific paired assets, namely barr.svg and lg.svg. Stolen credentials were then typically POSTed to endpoints such as next.php or save.php. This unique fingerprint provided defenders with a reliable method for identifying Kratos-related phishing attempts, boasting a 90% recall rate with near-zero false positives, a valuable indicator for proactive threat hunting.

The Business Model of Cybercrime: Franchising Deception

Kratos operated akin to a criminal franchise, offering a Phishing-as-a-Service model that lowered the barrier to entry for aspiring cybercriminals, whom the BKA aptly termed "franchisees." These customers paid for the service using cryptocurrency, a common choice in illicit online transactions due to its perceived anonymity. Access to the Kratos platform was managed through a dedicated website and a Telegram channel, providing a user-friendly interface for criminals to sign up, manage their accounts, and orchestrate their phishing campaigns. This streamlined operation meant that even individuals with relatively low technical skills could deploy a sophisticated AiTM phishing kit against targets, significantly broadening the reach and impact of such attacks.

Investigators estimate that approximately 1,800 paying customers utilized Kratos, collectively launching an astounding 15,000 phishing campaigns each month. This volume of activity underscores the kit’s popularity and the demand for readily available, effective cybercrime tools. The authorities calculate that the operators of Kratos generated over 300,000 euros in illicit profits since late 2024. Each individual campaign had the potential to target several thousand recipients, leading to a staggering number of victims.

Victims and Vulnerabilities: The Widespread Impact

The impact of Kratos-powered campaigns was extensive, affecting hundreds of thousands of victims since late 2024. These victims were geographically dispersed across more than 30 countries, with a significant concentration in Europe and the United States. The stolen data included not just login credentials but, crucially, session cookies that bypassed MFA.

Stolen Microsoft logins, often a primary target for Kratos, are rarely the end of the line for cybercriminals. The BKA emphasized that these compromised credentials and session tokens could be exploited in multiple ways:

1. Further Phishing: Attackers could use compromised accounts to launch more credible phishing attacks from within trusted organizations, leveraging existing contacts and internal communication channels.
2. Sale on Darknet Markets: Stolen credentials and access to compromised accounts are valuable commodities on darknet marketplaces, sold to other criminals for various nefarious purposes.
3. Foothold for Business Email Compromise (BEC): Perhaps the most significant risk for organizations is the use of stolen credentials as an initial foothold for more advanced attacks, such as Business Email Compromise (BEC). Once inside a corporate Microsoft 365 environment, attackers can spread laterally, impersonate executives, divert funds, or launch ransomware attacks, leading to devastating financial and reputational damage. The path from a single phished inbox to a full-blown corporate compromise is well-trodden and represents a persistent threat.

Official Response and International Collaboration

The successful takedown of Kratos serves as a powerful testament to the effectiveness of international cooperation in the fight against cybercrime. Carsten Meywirth, who heads the BKA’s cybercrime division, lauded the operation, stating that it "shows that even highly professional phishing infrastructures can be effectively combated." His comments highlight the importance of persistent and coordinated efforts against increasingly sophisticated threats.

Benjamin Krause of the ZIT framed the operation as a clear demonstration of the office’s "disruptive" approach. This strategy focuses on actively dismantling criminal services and infrastructure outright, rather than merely apprehending individuals. While arrests are crucial for justice, disabling the operational tools significantly impedes criminal activity and raises the cost and effort for cybercriminals to rebuild.

While specific statements from US and Indonesian authorities were not detailed in the initial announcement, their involvement implies a strong commitment to cross-border collaboration. The US Federal Bureau of Investigation (FBI) and the Department of Justice (DOJ) are frequently involved in such international operations, providing intelligence, technical assistance, and legal frameworks for prosecution. The Indonesian National Police, by executing the arrest, showcased their capacity to act decisively on intelligence shared by international partners, reinforcing the global front against cybercrime. This collaborative model is increasingly vital as cyber threats transcend national boundaries, necessitating a unified global response.

Strengthening Defenses: Lessons from Kratos

In the wake of the Kratos takedown, Microsoft is actively notifying users whose accounts were compromised in the campaigns. The recommended remediation steps depend on the nature of the compromise:

• Credential Theft Only: If only credentials were harvested, a password reset combined with an MFA check is sufficient to secure the account.
• Live Session Theft (Reverse-Proxy Mode): For accounts where Kratos’s reverse-proxy mode lifted a live session, simply resetting the password is not enough, as the stolen session might still be active. In such cases, the compromised session must be explicitly revoked. Furthermore, for high-value accounts, Microsoft strongly recommends transitioning to "phishing-resistant sign-in" methods.

Phishing-resistant sign-in refers to authentication methods that are inherently immune to phishing attacks, even those employing sophisticated AiTM techniques. Examples include hardware security keys (e.g., FIDO2/WebAuthn), certificate-based authentication, or Windows Hello for Business. These methods do not transmit secrets that can be intercepted or relayed, making them far more secure against the types of attacks Kratos facilitated.

For organizations and defenders, ANY.RUN’s identified "tell" – the presence of barr.svg and lg.svg assets and POSTing to next.php or save.php – provides actionable intelligence for proactive threat hunting and incident response. Implementing robust monitoring for these indicators can help identify and block Kratos-powered phishing pages before they can cause widespread damage. Regular security awareness training, emphasizing the dangers of clicking suspicious links and verifying sender identities, remains a foundational defense.

The Enduring Challenge: A Temporary Victory?

While the immediate impact of the Kratos takedown is significant – with servers offline and campaigns effectively halted – the broader challenge of PhaaS platforms and sophisticated phishing remains. The operation did not apprehend the roughly 1,800 customers who used Kratos, nor did it seize the kit code they likely possess. As ANY.RUN observed, Kratos often ran on disposable domains, compromised WordPress sites, and shared hosting environments, a common characteristic of resilient cybercrime operations. This modular and distributed nature means that the kit, or a close variant, could reappear under a new name or be re-established by its "franchisees" using different infrastructure once the heat dies down.

This reality underscores the "whack-a-mole" nature of fighting cybercrime. Takedowns like Kratos are crucial victories, disrupting current operations, sending a strong message to other cybercriminals, and buying valuable time for defenders. However, they are not ultimate solutions. The constant evolution of attack techniques, the profitability of cybercrime, and the global reach of threat actors mean that law enforcement and cybersecurity professionals must remain vigilant, continually adapting their strategies and fostering international cooperation. The Kratos takedown is a powerful reminder that while the battle against cybercrime is ongoing, focused, collaborative efforts can yield substantial results in protecting individuals and organizations from pervasive digital threats.

For continued updates on cybersecurity threats and defensive strategies, follow leading cybersecurity news outlets on platforms such as Google News, Twitter, and LinkedIn.