Loading malware…
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Kratos gave low-skill criminals the tools to build convincing, Microsoft-themed login pages designed to harvest usernames, passwords and session cookies, allowing attackers to bypass multi-factor authentication and take over victims’ accounts. The BKA said compromised accounts were often used to carry out further crimes.
инфраструктуру фишинговой платформы Kratos, которая использовалась для кражи аккаунтов Microsoft 365
On February 10, operators sent tax-themed emails to about 100 organizations... each carrying a W-2 document with a QR code personalized to the recipient that led to a fake Microsoft 365 login.
...each carrying a W-2 document with a QR code personalized to the recipient that led to a fake Microsoft 365 login.
Kratos gave low-skill criminals the tools to build convincing, Microsoft-themed login pages designed to harvest usernames, passwords and session cookies, allowing attackers to bypass multi-factor authentication and take over victims’ accounts. The BKA said compromised accounts were often used to carry out further crimes.
Kratos gave low-skill criminals the tools to build convincing, Microsoft-themed login pages designed to harvest usernames, passwords and session cookies, allowing attackers to bypass multi-factor authentication and take over victims’ accounts. The BKA said compromised accounts were often used to carry out further crimes.
Kratos gave low-skill criminals the tools to build convincing, Microsoft-themed login pages designed to harvest usernames, passwords and session cookies, allowing attackers to bypass multi-factor authentication and take over victims’ accounts. The BKA said compromised accounts were often used to carry out further crimes.
использовалась для кражи аккаунтов Microsoft 365 и обхода многофакторной аутентификации
перехватывал созданную после входа сессию. В результате злоумышленники получали не только логин и пароль, но и сессионный cookie
В первом использовалась обычная PHP-страница, которая собирала логины и пароли жертв
Kratos gave low-skill criminals the tools to build convincing, Microsoft-themed login pages designed to harvest usernames, passwords and session cookies, allowing attackers to bypass multi-factor authentication and take over victims’ accounts.
...a Node.js reverse proxy designed to relay the login to Microsoft in real time and capture the resulting session.
Kratos gave low-skill criminals the tools to build convincing, Microsoft-themed login pages designed to harvest usernames, passwords and session cookies, allowing attackers to bypass multi-factor authentication and take over victims’ accounts.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.