International Law Enforcement Dismantle World’s Most Dangerous Phishing Platform 🎣

German and United States law-enforcement authorities have dismantled the central infrastructure supporting Kratos, a large-scale phishing-as-a-service platform accused of helping cybercriminals steal Microsoft 365 credentials, intercept authentication sessions and circumvent conventional multifactor authentication protections.

More than 200 servers were taken offline during the internationally coordinated operation, effectively disabling the service’s centrally managed infrastructure. Indonesian authorities also arrested the alleged developer and technical administrator of the platform.

Germany’s Federal Criminal Police Office (BKA) and the Frankfurt public prosecutor’s Central Office for Combating Internet Crime (ZIT) described Kratos as one of the world’s most dangerous and extensively used commercial phishing services.

Investigators believe more than 1,800 criminal customers acquired access to the platform and collectively launched approximately 15,000 phishing campaigns every month. Each campaign could target several thousand email addresses, giving the service the capacity to expose a vast number of individuals and organisations to credential theft.

Since the end of 2024, Kratos campaigns are suspected of reaching hundreds of thousands of victims across more than 30 countries, with most of the identified activity concentrated in Europe and the United States. The operators allegedly generated more than €300,000 in criminal revenue during that period, according to the official BKA announcement.

Kratos was not merely a collection of fraudulent login templates. Investigators and security researchers describe it as a professionally operated phishing-as-a-service, or PhaaS, platform that provided much of the infrastructure required to organise and manage credential-theft campaigns.

The service allowed customers—described by German investigators as criminal “franchisees”—to create convincing copies of Microsoft authentication pages without developing their own phishing tools or maintaining sophisticated infrastructure.

Customers reportedly purchased access using cryptocurrency and managed their accounts through a dedicated website and a Telegram-based shop. The commercial model placed advanced phishing capabilities within reach of criminals who may otherwise have lacked the technical expertise to build an adversary-in-the-middle platform.

Kratos could generate phishing pages, manage campaigns and collect information submitted by victims. Depending on the selected configuration, customers could use the platform for conventional password theft or deploy a more advanced reverse-proxy system capable of intercepting live Microsoft 365 authentication sessions.

This distinction was critical because the reverse-proxy mode allowed criminals to target accounts protected by some forms of MFA.

An investigation by interactive malware-analysis company ANY.RUN identified two principal operating modes within Kratos.

The first used conventional PHP-based credential-harvesting pages. These websites imitated Microsoft’s sign-in interface and captured email addresses and passwords entered by victims. The stolen information was then transmitted to infrastructure controlled by the phishing operator.

This approach could provide access to accounts that did not require MFA, or allow criminals to reuse passwords against other services. However, it would normally be stopped when Microsoft required the legitimate account holder to complete an additional authentication challenge.

The second and more dangerous mode used a Node.js reverse proxy to position Kratos between the victim and Microsoft’s legitimate authentication service.

Instead of presenting an entirely static imitation, the phishing server relayed requests and responses between the victim’s browser and Microsoft in real time. The victim entered a genuine username and password and then completed the requested MFA challenge, believing they were signing in normally.

Microsoft accepted the authentication because the victim had supplied valid credentials and approved the second factor. Kratos, however, remained in the middle of the exchange and captured the authentication token or session cookie returned after the successful login.

Armed with that session information, the attacker could impersonate the authenticated user without repeating the entire login process. This is why an adversary-in-the-middle attack is commonly described as bypassing MFA: it does not necessarily break the second factor, but instead steals the authenticated session created after the victim has successfully completed it.

Microsoft explains that AiTM phishing platforms intercept authentication traffic so they can collect credentials, MFA information and the resulting session cookie. The stolen cookie can subsequently be replayed to access the victim’s account while the session remains valid. Microsoft has documented this technique in several investigations involving Microsoft 365 account compromise.

The Kratos operation illustrates an important limitation of MFA methods that are not resistant to phishing.

SMS codes, one-time passwords and push-notification approvals remain substantially more secure than relying on a password alone. They can prevent many automated credential-stuffing attacks and stop criminals who possess only a stolen password.

They do not, however, reliably prevent a victim from authenticating through a malicious reverse proxy. If the victim enters the password and completes the second-factor challenge while connected to an attacker-controlled site, the proxy may capture the authenticated session.

The attacker can then use that session until it expires, is revoked or becomes unusable because of another security control. In some cases, criminals act almost immediately, accessing the mailbox, downloading data, modifying account settings or establishing a more durable method of access before defenders recognise the intrusion.

This makes the theft of a session cookie significantly more serious than the theft of a password alone. Resetting a password may prevent future authentication with the compromised credential, but it does not necessarily terminate every session or token already issued before the reset.

Microsoft advises organisations responding to suspected session-cookie theft to reset compromised credentials and disable or revoke the associated tokens. Administrators can block the account temporarily and use the Microsoft Entra administration interface to revoke active sessions and refresh tokens. Microsoft’s emergency access-revocation guidance provides the relevant containment procedures.

Kratos had already attracted the attention of Microsoft Threat Intelligence, which tracks the phishing platform under the name SneakyLog.

Microsoft said the service had been operating since at least early 2025 and was designed to steal Microsoft 365 credentials. Its research connected the kit to tax-themed phishing operations aimed primarily at organisations in the United States.

In one campaign observed on February 10, 2026, the attackers sent phishing emails to approximately 100 organisations across the manufacturing, retail and healthcare sectors. The messages used the subject line “2025 Employee Tax Docs” and carried Microsoft Word attachments presented as employee W-2 documentation.

Each document was personalised with the recipient’s name and contained a QR code leading to a fraudulent Microsoft 365 sign-in page. The URL encoded within the QR code also included the intended victim’s email address, allowing the phishing page to appear personalised when opened.

QR codes can make phishing attempts more difficult for some email-security systems to analyse because the malicious destination is embedded inside an image rather than displayed as an ordinary hyperlink. Victims may also scan the code using a mobile device outside their organisation’s managed network and security controls.

Microsoft attributed the fraudulent login pages used in that operation to SneakyLog, the same service identified by German investigators as Kratos. The company also observed tax-related domains prepared for use in similar operations during January and February 2026. Microsoft’s investigation documented the use of personalised documents, tax terminology and impersonation of legitimate financial or accounting organisations.

The timing of these campaigns was unlikely to be accidental. Tax season provides criminals with familiar document types, a sense of urgency and plausible reasons for employees to open unfamiliar files or sign in to view sensitive information.

Compromising a Microsoft 365 account can give an attacker access to much more than one email inbox.

Depending on the account’s permissions and the organisation’s configuration, a stolen session may expose email, calendars, contacts, files stored in OneDrive or SharePoint, Teams conversations and other connected cloud services. A compromised administrator or executive account can create considerably greater risk.

Attackers frequently search stolen mailboxes for invoices, payment discussions, contracts, customer information and internal correspondence. They may create inbox rules that hide replies or security notifications, monitor an ongoing financial transaction, and then insert themselves into the conversation at the most advantageous moment.

This can lead to business email compromise, in which criminals impersonate a trusted employee, executive, supplier or customer to request a fraudulent payment or redirect an authentic transaction to a bank account under their control.

The compromised account can also be used to launch additional phishing attacks. Messages sent from a legitimate internal mailbox carry an inherited level of trust, particularly when attackers reply within an existing conversation or distribute a malicious document from a recognised SharePoint or OneDrive location.

Microsoft previously documented AiTM intrusions in which stolen session cookies were used to access mailboxes and conduct follow-on financial fraud. In those cases, the initial phishing page was only the entry point into a larger attack sequence involving account reconnaissance, mailbox manipulation and impersonation. Microsoft’s research into AiTM-driven business email compromise describes this progression.

ANY.RUN’s reverse engineering of Kratos identified technical characteristics that organisations can use to hunt for related phishing activity.

Researchers analysed more than 1,600 sandbox sessions connected to the two principal generations of the kit. Only a relatively small proportion had previously been manually identified as Kratos, suggesting that much of the service’s historical activity had remained unattributed or had been detected only through generic phishing classifications.

One of the strongest fingerprints was the presence of two image assets named barr.svg and lg.svg. Researchers found that the files appeared together on Kratos pages with unusual consistency and were rarely paired on unrelated websites.

ANY.RUN said searching for the two assets together provided approximately 90% recall with a false-positive rate close to zero. Kratos pages were also observed transmitting captured data to PHP endpoints including next.php and save.php.

The filenames should not be treated as permanent indicators. Criminal developers can change static resources quickly once detection methods become public. Nevertheless, they can help defenders retrospectively search proxy records, secure web gateway telemetry, browser data, network captures and previously submitted sandbox samples.

Researchers also found Kratos deployments on newly registered or disposable domains, compromised WordPress websites and infrastructure shared with other adversary-in-the-middle phishing kits. That varied hosting model made the operation more resilient and reduced its reliance on a single visible domain pattern. The complete technical findings and detection details are available in ANY.RUN’s Kratos analysis.

The removal of more than 200 servers represents a substantial disruption because commercial phishing services often depend on central systems for customer management, subscriptions, campaign administration, data collection and software updates.

Taking those systems offline can prevent customers from accessing control panels, deploying new campaigns through the service and retrieving newly stolen information. Arresting the alleged developer and technical administrator may also make it harder for the operation to restore its infrastructure immediately.

Carsten Meywirth, head of the BKA’s cybercrime division, said the operation demonstrated that highly professional phishing infrastructure could be effectively challenged through international cooperation.

Benjamin Krause, who leads ZIT, described the action as an example of a disruptive law-enforcement strategy aimed at dismantling a criminal service and preventing further offences, rather than limiting the investigation to identifying and prosecuting individual participants.

The authorities said shutting down Kratos prevented additional attacks against hundreds of thousands of potential victims.

The takedown does not necessarily remove every copy of the phishing software already distributed to customers.

With approximately 1,800 suspected criminal subscribers, investigators face a much wider ecosystem than the platform’s central development and administration team. Individual customers may retain phishing templates, victim lists, stolen data or components that can be moved to other hosting providers.

Some operators may migrate to competing phishing-as-a-service platforms. Others could attempt to operate modified versions of the kit independently or repackage the technology under a different name.

This is a recurring challenge in cybercrime disruption. Removing central infrastructure can sharply reduce activity and deprive criminals of a reliable managed service, but the underlying techniques, software and demand do not disappear. The longer-term effect will depend on whether investigators can identify additional administrators, infrastructure providers, resellers and high-volume customers from the evidence seized during the operation.

Data obtained from payment systems, Telegram accounts, customer databases and server logs could potentially support further investigations, although authorities have not publicly disclosed the full scope of the evidence collected.

Microsoft is notifying customers and users identified as potential victims of Kratos-linked campaigns.

The appropriate response depends on whether a user merely entered a password into a static phishing page or completed an authentication flow through the reverse-proxy component.

Where only credentials were exposed, organisations should reset the password, review registered authentication methods and examine sign-in activity for evidence of unauthorised access.

Where an authenticated session may have been intercepted, administrators should assume that changing the password alone may be insufficient. Active sessions and refresh tokens should also be revoked, and the account should be temporarily blocked if an intrusion is suspected.

Investigators should review Entra sign-in logs, mailbox audit records, inbox and forwarding rules, OAuth application permissions, newly registered authentication methods, device registrations and access to SharePoint, OneDrive and Teams. They should also determine whether the compromised account sent messages or shared files with other users.

Microsoft’s token-theft response guidance recommends changing exposed passwords, blocking affected users, revoking access, marking relevant accounts as compromised and investigating attacker infrastructure. The company’s token-theft playbook provides a broader containment and investigation framework.

The most effective long-term defence against reverse-proxy credential phishing is to require authentication methods that validate the legitimate website before completing the authentication process.

Microsoft recommends phishing-resistant methods including passkeys based on FIDO2, physical FIDO2 security keys, Windows Hello for Business, platform credentials and certificate-based authentication. Unlike one-time codes, these methods use cryptographic mechanisms tied to the legitimate service’s domain.

A passkey authenticator should therefore refuse to authenticate to a lookalike phishing domain, even when the fraudulent page closely resembles Microsoft’s genuine login interface. Microsoft describes this property as verifier impersonation resistance: the authenticator releases the required proof only to the service for which the credential was registered. Microsoft’s passkey documentation explains how this protection works.

Organisations can use Microsoft Entra Conditional Access authentication-strength policies to require phishing-resistant methods for administrators, executives, finance personnel and other high-risk users. Wider deployment can then follow as device compatibility, enrolment and account-recovery procedures are established.

Additional protections should include token binding where supported, device-compliance requirements, risk-based Conditional Access, controls restricting access from unmanaged devices and rapid investigation of anomalous token activity.

The dismantling of Kratos removes a significant provider from the commercial phishing market, but it also highlights how far phishing operations have evolved. Modern platforms are no longer limited to collecting passwords from crude imitation websites. They provide subscriptions, automated deployment, reverse-proxy infrastructure and customer management systems capable of turning account hijacking into a scalable service.

For organisations still relying primarily on passwords and code-based MFA, the operation offers a clear warning: stopping modern identity attacks increasingly requires protecting the authenticated session itself, not only the credentials used to create it.