Kratos

A “Review and Sign” button then redirected the victim to an EvilTokens device code harvesting page disguised as an Adobe Acrobat document-sharing authentication screen.

This allowed operators to access the account as an already verified user, meaning a password reset alone might not end the intrusion if active sessions and refresh tokens remain valid.

The campaigns used fake accounts impersonating senior executives to send document-sharing notifications from legitimate Notion infrastructure.

On February 10, operators sent tax-themed emails to about 100 organizations... each carrying a W-2 document with a QR code personalized to the recipient that led to a fake Microsoft 365 login.

Kratos gave low-skill cybercriminals a way to steal login credentials such as passwords and email addresses through convincing Microsoft-themed phishing pages.

...each carrying a W-2 document with a QR code personalized to the recipient that led to a fake Microsoft 365 login.

This allowed operators to access the account as an already verified user, meaning a password reset alone might not end the intrusion if active sessions and refresh tokens remain valid.

This allowed operators to access the account as an already verified user, meaning a password reset alone might not end the intrusion if active sessions and refresh tokens remain valid.

Starting with V1... the kit moves to direct brand impersonation, closely replicating the Microsoft Sign In window.

This allowed operators to access the account as an already verified user, meaning a password reset alone might not end the intrusion if active sessions and refresh tokens remain valid.

Before loading a fake Microsoft sign-in form, Kratos could present a CAPTCHA or browser check to screen out automated scanners.

Kratos gave low-skill cybercriminals a way to steal login credentials such as passwords and email addresses through convincing Microsoft-themed phishing pages.

использовалась для кражи аккаунтов Microsoft 365 и обхода многофакторной аутентификации

When a user entered credentials and completed multi-factor authentication, the kit relayed the live session and collected the authentication token.

В первом использовалась обычная PHP-страница, которая собирала логины и пароли жертв

By placing itself between the victim and Microsoft’s real authentication system, Kratos could capture passwords and active session tokens, a technique also seen in AiTM phishing attack methods that can weaken the protection offered by multi-factor authentication.

Sneaky2FA relayed live authentication sessions between a victim and Microsoft's real login servers, letting the operator capture both credentials and session tokens as they passed through, which is what let the kit defeat MFA rather than just harvest a password.

Attackers with Microsoft 365 access may... steal files from SharePoint, Teams, and OneDrive...

Before loading a fake Microsoft sign-in form, Kratos could present a CAPTCHA or browser check to screen out automated scanners.

Attackers with Microsoft 365 access may read business conversations, change payment instructions, steal files from SharePoint, Teams, and OneDrive, or use a trusted account to send new phishing messages to colleagues, customers, and suppliers.

Kratos gave low-skill cybercriminals a way to steal login credentials such as passwords and email addresses through convincing Microsoft-themed phishing pages.

Attackers with Microsoft 365 access may read business conversations...

Monitoring mailbox rules is also important because compromised accounts can be used to quietly redirect financial messages or hide security alerts...

By placing itself between the victim and Microsoft’s real authentication system, Kratos could capture passwords and active session tokens, a technique also seen in AiTM phishing attack methods that can weaken the protection offered by multi-factor authentication.

Its affiliates could imitate familiar services such as document-sharing and creative-software platforms, then send emails that routed victims through SharePoint, OneDrive, Microsoft Forms, Canva, or other legitimate web services before reaching the final trap.

Access to these accounts was often leveraged to 'commit further crimes,' states BKA, hinting at post-compromise activity such as business email compromise, data theft, account takeover, and phishing attacks targeting the victims’ contacts.

Credential theft → POST request to a PHP endpoint V1: next.php V2: save.php V0: /PTT/SOft/mini.php