Loading story…
German authorities, supported by the United States and Indonesia, dismantled the main infrastructure behind the Kratos phishing-as-a-service platform and reportedly neutralized more than 200 servers, while Indonesian authorities arrested the alleged developer and technical administrator. Investigators said the kit had been used by more than 1,800 criminal groups to launch roughly 15,000 phishing campaigns each month across more than 30 countries, primarily targeting organizations in the US and Europe. Also tracked as SneakyLog and Sneaky 2FA, Kratos was designed to steal credentials and session cookies through convincing Microsoft-themed phishing pages, enabling attackers to bypass multifactor authentication and compromise Microsoft 365 accounts.
Threat reporting had previously tied Kratos to broad phishing waves using lures themed around tax documents, IRS notices, CPA requests, and cryptocurrency tax forms, with victims spanning financial services, healthcare, education, retail, manufacturing, technology, law firms, schools, and SMBs. Campaigns impersonated services including SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and Adobe, and used evasive delivery methods such as QR codes, OneNote and Excel attachments, URL shorteners, cloud-hosted pages, and bot filtering. In one IRS-themed campaign, attackers targeted more than 29,000 users across 10,000 organizations and delivered a malicious ScreenConnect-based "Transcript Viewer" executable, showing how credential theft operations tied to Kratos also supported broader post-compromise access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
German authorities announced the takedown of the main infrastructure behind the Kratos phishing-as-a-service kit, with support from the United States and Indonesia. The operation reportedly neutralized more than 200 servers, and Indonesian authorities arrested the alleged developer and technical administrator.
Microsoft Threat Intelligence reported that early 2026 saw a seasonal increase in U.S. tax-themed phishing and malware activity targeting individuals, accountants, tax preparers, and organizations across multiple sectors. The campaigns used phishing kits including Energy365 and SneakyLog/Kratos and also abused remote monitoring and management tools such as ScreenConnect, SimpleHelp, and Datto.
On February 10, 2026, a large tax-themed phishing campaign impersonating the IRS targeted more than 29,000 users across 10,000 organizations. The campaign delivered a malicious ScreenConnect-based executable presented as a "Transcript Viewer."
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcemicrosoft.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German authorities, working with the United States and Indonesia, dismantled the core infrastructure of **Kratos**, a phishing-as-a-service platform described as one of the world’s most widely used criminal phishing services. Investigators seized or neutralized more than 200 servers and arrested the alleged developer and technical administrator in Indonesia, a move authorities said rendered the service inoperable. The action was carried out under **Operation Olympus Blade**, and the FBI took control of Kratos-linked domains to support follow-on investigation and customer identification. Kratos supplied Microsoft-themed phishing pages designed to steal credentials and session cookies, allowing attackers to hijack accounts and bypass multi-factor authentication. Authorities said the platform was used by roughly **1,800 criminal customers** to launch about **15,000 phishing campaigns per month** against victims in at least **35 countries**, with organizations in the United States and Europe—particularly in manufacturing, retail, healthcare, and education—among the main targets. Investigators estimate the operation generated more than **€300,000** since 2024.
Jul 22, 2026
Microsoft disclosed a large-scale phishing campaign that targeted more than **35,000 users** at over **13,000 organizations** across **26 countries**, with most victims in the United States and concentrations in healthcare, life sciences, financial services, professional services, and technology. The operation used code-of-conduct and compliance-themed emails delivered through legitimate email services, including abuse of platforms such as Amazon SES, to make messages appear trustworthy and help them pass common email authentication checks. Victims received PDF attachments containing links that led through fake CAPTCHA and document-review pages before landing on spoofed Microsoft sign-in portals. Microsoft said the attackers used an **adversary-in-the-middle** phishing flow to capture credentials and authentication tokens in real time, allowing them to bypass weak multifactor authentication and gain immediate account access. The company described the activity as one of the most sophisticated code-of-conduct-themed credential theft campaigns it has observed and said it reflects broader trends including CAPTCHA-gated phishing, QR-code phishing, and phishing-as-a-service ecosystems such as **Tycoon 2FA**, **Kratos**, and **EvilTokens**. Microsoft urged organizations to strengthen defenses with Defender for Office 365, SmartScreen-enabled browsers, phishing awareness training, stronger authentication, conditional access policies, and automated attack disruption in Defender XDR.
Jun 29, 2026
A sophisticated, multi-stage phishing campaign has been observed targeting organizations globally to steal Microsoft 365 credentials. The operation, monitored since early November 2025, employs advanced evasion techniques such as nested PDFs, use of legitimate content delivery networks, and mouse tracking to bypass secure email gateways and multi-factor authentication. The final credential harvesting site is engineered to block security tools and analysts, and leverages legitimate Microsoft infrastructure to circumvent MFA, granting attackers immediate access to compromised accounts. These attacks highlight the increasing complexity of phishing operations and their ability to evade traditional security controls. In parallel, threat actors are exploiting free cloud hosting platforms like Cloudflare Pages to host convincing phishing portals impersonating banking and healthcare providers. These sites not only harvest credentials but also collect additional security information, such as answers to secret questions, and exfiltrate data via Telegram bots to evade detection. Attackers use compromised legitimate domains as redirectors, increasing the likelihood of bypassing spam filters and making takedown efforts more challenging. The convergence of advanced phishing techniques and abuse of trusted cloud services underscores the need for enhanced detection and response strategies for organizations relying on Microsoft 365 and similar platforms.
Jun 29, 2026