German and US Law Enforcement Dismantle "Kratos," a Leading Global Phishing-as-a-Service Operation, Arresting Key Developer in Indonesia

German and US law enforcement agencies, in a coordinated international effort, have successfully dismantled the core infrastructure of "Kratos," a sophisticated phishing-as-a-service (PhaaS) operation identified as one of the most widely utilized criminal tools globally. The operation, which enabled cybercriminals to conduct large-scale phishing campaigns with relative ease, was brought down through the seizure of over 200 servers. Concurrently, Indonesian authorities apprehended a man alleged to be the developer and operator of the Kratos platform.

The joint announcement, made on Monday by the Frankfurt Public Prosecutor’s Office’s Cybercrime Unit (ZIT) and Germany’s Federal Criminal Police Office (BKA), detailed the significant impact of the takedown. Investigators estimate that approximately 1,800 paying customers were actively utilizing Kratos, orchestrating an estimated 15,000 phishing campaigns per month. This widespread operation highlights the evolving threat landscape and the increasing reliance of cybercriminals on organized, service-oriented platforms.

The Sophistication of Kratos: Beyond Simple Credential Harvesting

What set Kratos apart from more rudimentary phishing kits was its advanced capabilities, extending beyond the mere collection of usernames and passwords. The BKA revealed that the kit was specifically engineered to steal session cookies in addition to login credentials. This seemingly minor addition posed a significant threat, as a stolen session cookie can often bypass multi-factor authentication (MFA) mechanisms, allowing attackers to impersonate legitimate users and gain unauthorized access to accounts.

Security researchers at ANY.RUN, who conducted an in-depth reverse-engineering analysis of the Kratos kit, shed further light on its technical prowess. They identified two primary operational modes available to Kratos users. The first was a straightforward PHP page designed solely for harvesting credentials. The more insidious of the two, however, was a Node.js reverse proxy. This advanced feature was capable of relaying login attempts to legitimate services, such as Microsoft, in real-time, while simultaneously capturing the subsequent session cookie. This "adversary-in-the-middle" (AiTM) technique effectively neutralizes ordinary MFA, rendering it a significantly weaker security control than commonly perceived.

A Franchise Model for Cybercrime

The operational structure of Kratos was likened to a franchise, with its paying customers acting as "franchisees." These individuals or groups paid for access to the platform using cryptocurrency, managing their accounts and orchestrating their phishing campaigns through a dedicated website and a Telegram shop. This model lowered the barrier to entry for aspiring cybercriminals, allowing even individuals with limited technical expertise to deploy sophisticated attacks against unsuspecting targets. The ease of use and the availability of advanced tools meant that the reach and impact of Kratos were amplified considerably.

Scale of the Operation and Financial Gains

Authorities estimate that since late 2024, the Kratos operation has victimized hundreds of thousands of individuals across more than 30 countries, with a particular concentration of attacks in Europe and the United States. The financial gains for the operators are substantial; they are estimated to have earned over 300,000 euros since the beginning of 2024. The BKA further indicated that each individual phishing campaign launched through Kratos could potentially reach several thousand recipients, underscoring the massive scale of its operations.

Previous Tracking and "SneakyLog"

The Kratos operation was not entirely unknown to cybersecurity professionals. Microsoft Threat Intelligence had previously identified the same kit under the alias "SneakyLog." Microsoft’s analysis indicated that SneakyLog had been operating as a phishing-as-a-service platform since at least early 2025, specifically targeting Microsoft 365 accounts for credential and two-factor authentication theft. Microsoft had even documented instances of campaigns leveraging this kit, including one observed during the peak tax season, where attackers used tax-related lures to ensnare victims.

One notable campaign, detailed by Microsoft, occurred on February 10th. In this instance, Kratos operators dispatched tax-themed emails to approximately 100 organizations, predominantly located in the United States and spanning sectors such as manufacturing, retail, and healthcare. These emails contained a W-2 document embedded with a personalized QR code. Upon scanning, the QR code directed recipients to a fraudulent Microsoft 365 login page, designed to harvest their credentials.

The Broader Implications of Stolen Credentials

The consequences of stolen Microsoft 365 credentials extend far beyond mere account access. The BKA emphasized that compromised credentials could be exploited for further phishing attacks, sold on the dark web to other criminal entities, or used as an entry point to infiltrate corporate networks. The interconnected nature of Microsoft 365 environments means that a single compromised inbox can serve as a gateway for attackers to spread laterally, potentially leading to widespread business email compromise (BEC) incidents. This highlights the cascading effect of successful phishing attacks on organizational security.

Official Statements and the Efficacy of Law Enforcement Action

Carsten Meywirth, head of the BKA’s cybercrime division, expressed confidence in the operation’s success, stating that it demonstrates "that even highly professional phishing infrastructures can be effectively combated." Benjamin Krause from the ZIT framed the takedown as a testament to the office’s "disruptive" strategy, focusing on dismantling criminal services at their source rather than solely prosecuting individual actors. This proactive approach aims to prevent future harm by eliminating the infrastructure that enables widespread criminal activity.

Microsoft’s Response and Remediation Measures

Microsoft has confirmed that it is actively notifying users who were affected by the Kratos campaigns. The remediation steps vary depending on the method of compromise. For victims whose credentials were simply harvested, resetting their password and ensuring their MFA is correctly configured should suffice. However, for those whose sessions were compromised via the reverse-proxy mode, simply resetting the password is not enough. In such cases, the compromised session must be explicitly revoked, and high-value accounts may require migration to phishing-resistant sign-in methods.

Identifying Kratos: Technical Indicators for Defenders

For cybersecurity defenders looking to identify potential exposure to Kratos, specific technical indicators have been identified. ANY.RUN’s analysis revealed that Kratos login pages consistently load two paired assets: barr.svg and lg.svg. Furthermore, stolen credentials are typically POSTed to endpoints such as next.php or save.php. The pairing of these elements has been rated by ANY.RUN as having a 90% recall rate with near-zero false positives, making it a valuable signature for threat hunting.

The Road Ahead: Persistent Threats and Evolving Tactics

While the takedown of the Kratos server infrastructure is a significant victory, the threat is far from eradicated. The BKA acknowledges that the roughly 1,800 customers who utilized the service, along with the kit code they possess, remain at large. The nature of cybercrime means that dismantled operations often resurface under new names or utilize alternative hosting methods. ANY.RUN’s findings indicate that Kratos was previously hosted on disposable domains, compromised WordPress sites, and shared hosting environments with other AiTM kits. This adaptability suggests that the Kratos operation, or its successor, may re-emerge in a different form.

The long-term implications of this operation underscore the ongoing global challenge of combating cybercrime. The reliance on sophisticated, service-oriented platforms like Kratos signifies a professionalization of cybercriminality, requiring equally sophisticated and coordinated responses from law enforcement and cybersecurity professionals worldwide. The success of this joint operation, however, offers a strong precedent for future international collaborations in disrupting and dismantling large-scale cyber threats. The continuous evolution of phishing techniques, particularly those that circumvent multi-factor authentication, necessitates ongoing vigilance and the adoption of advanced security measures by both individuals and organizations.