Loading malware…
Kratos is a subscription-based phishing-as-a-service platform targeting Microsoft 365 accounts. It evolved from Sneaky2FA and is also tracked by Microsoft as SneakyLog. The service provides criminal affiliates with counterfeit Microsoft authentication pages, deployment and hosting management, anti-bot controls, geographic filtering, and automated delivery of stolen information through Telegram or email. Its customer dashboard supports phishing-page deployment, DNS configuration, certificate installation, and server management.
Kratos supports both credential-harvesting pages and an adversary-in-the-middle reverse-proxy mode. The former collects submitted login information, while the latter relays legitimate Microsoft authentication flows and captures authenticated session cookies, enabling account access despite completion of multifactor authentication. Campaigns commonly use document-sharing, invoice, and DocuSign-themed phishing emails, sometimes with PDF or QR-code intermediaries. Victims are frequently routed through legitimate services, including SharePoint, OneDrive, Microsoft Forms, and Canva, before reaching counterfeit sign-in pages. Configurable CAPTCHA challenges, including Cloudflare Turnstile, obstruct automated inspection. Deployments use both attacker-controlled infrastructure and compromised legitimate websites.
Kratos affiliates have targeted organizations across the United States, Europe, and other regions, including manufacturing, retail, healthcare, education, legal services, and small and medium-sized businesses. Stolen credentials and sessions enable Microsoft 365 account takeover and can facilitate business email compromise, payment fraud, data theft, and further phishing from trusted accounts.
On July 20, 2026, German and U.S. authorities disrupted Kratos's central infrastructure during Operation Olympus Blade, taking more than 200 servers offline. Indonesian authorities arrested its alleged developer and technical administrator. Investigators estimated that more than 1,800 criminal subscribers had used the service to conduct approximately 15,000 phishing campaigns per month, affecting hundreds of thousands of victims across more than 30 countries.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Bei Kratos handelte es sich um einen von der gleichnamigen Gruppierung entwickelten digitalen Baukasten, mit dem sich insbesondere täuschend echte Microsoft-Authentifizierungs-Webseiten erstellen und verwalten ließen.
22 distinct techniques documented for this family, organized by ATT&CK tactic.
A “Review and Sign” button then redirected the victim to an EvilTokens device code harvesting page disguised as an Adobe Acrobat document-sharing authentication screen.
This allowed operators to access the account as an already verified user, meaning a password reset alone might not end the intrusion if active sessions and refresh tokens remain valid.
The campaigns used fake accounts impersonating senior executives to send document-sharing notifications from legitimate Notion infrastructure.
On February 10, operators sent tax-themed emails to about 100 organizations... each carrying a W-2 document with a QR code personalized to the recipient that led to a fake Microsoft 365 login.
Kratos gave low-skill cybercriminals a way to steal login credentials such as passwords and email addresses through convincing Microsoft-themed phishing pages.
...each carrying a W-2 document with a QR code personalized to the recipient that led to a fake Microsoft 365 login.
This allowed operators to access the account as an already verified user, meaning a password reset alone might not end the intrusion if active sessions and refresh tokens remain valid.
This allowed operators to access the account as an already verified user, meaning a password reset alone might not end the intrusion if active sessions and refresh tokens remain valid.
Starting with V1... the kit moves to direct brand impersonation, closely replicating the Microsoft Sign In window.
This allowed operators to access the account as an already verified user, meaning a password reset alone might not end the intrusion if active sessions and refresh tokens remain valid.
Before loading a fake Microsoft sign-in form, Kratos could present a CAPTCHA or browser check to screen out automated scanners.
Kratos gave low-skill cybercriminals a way to steal login credentials such as passwords and email addresses through convincing Microsoft-themed phishing pages.
использовалась для кражи аккаунтов Microsoft 365 и обхода многофакторной аутентификации
When a user entered credentials and completed multi-factor authentication, the kit relayed the live session and collected the authentication token.
В первом использовалась обычная PHP-страница, которая собирала логины и пароли жертв
By placing itself between the victim and Microsoft’s real authentication system, Kratos could capture passwords and active session tokens, a technique also seen in AiTM phishing attack methods that can weaken the protection offered by multi-factor authentication.
Sneaky2FA relayed live authentication sessions between a victim and Microsoft's real login servers, letting the operator capture both credentials and session tokens as they passed through, which is what let the kit defeat MFA rather than just harvest a password.
Attackers with Microsoft 365 access may... steal files from SharePoint, Teams, and OneDrive...
Before loading a fake Microsoft sign-in form, Kratos could present a CAPTCHA or browser check to screen out automated scanners.
Attackers with Microsoft 365 access may read business conversations, change payment instructions, steal files from SharePoint, Teams, and OneDrive, or use a trusted account to send new phishing messages to colleagues, customers, and suppliers.
Kratos gave low-skill cybercriminals a way to steal login credentials such as passwords and email addresses through convincing Microsoft-themed phishing pages.
Attackers with Microsoft 365 access may read business conversations...
Monitoring mailbox rules is also important because compromised accounts can be used to quietly redirect financial messages or hide security alerts...
By placing itself between the victim and Microsoft’s real authentication system, Kratos could capture passwords and active session tokens, a technique also seen in AiTM phishing attack methods that can weaken the protection offered by multi-factor authentication.
Some sessions also establish a WebSocket connection.
Its affiliates could imitate familiar services such as document-sharing and creative-software platforms, then send emails that routed victims through SharePoint, OneDrive, Microsoft Forms, Canva, or other legitimate web services before reaching the final trap.
Access to these accounts was often leveraged to 'commit further crimes,' states BKA, hinting at post-compromise activity such as business email compromise, data theft, account takeover, and phishing attacks targeting the victims’ contacts.
Credential theft → POST request to a PHP endpoint V1: next.php V2: save.php V0: /PTT/SOft/mini.php
43 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.