Authorities Dismantle Kratos Phishing Kit Used in Large-Scale Microsoft 365 Credential Theft

German authorities, supported by the United States and Indonesia, dismantled the main infrastructure behind the Kratos phishing-as-a-service platform and reportedly neutralized more than 200 servers, while Indonesian authorities arrested the alleged developer and technical administrator. Investigators said the kit had been used by more than 1,800 criminal groups to launch roughly 15,000 phishing campaigns each month across more than 30 countries, primarily targeting organizations in the US and Europe. Also tracked as SneakyLog and Sneaky 2FA, Kratos was designed to steal credentials and session cookies through convincing Microsoft-themed phishing pages, enabling attackers to bypass multifactor authentication and compromise Microsoft 365 accounts.

Threat reporting had previously tied Kratos to broad phishing waves using lures themed around tax documents, IRS notices, CPA requests, and cryptocurrency tax forms, with victims spanning financial services, healthcare, education, retail, manufacturing, technology, law firms, schools, and SMBs. Campaigns impersonated services including SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and Adobe, and used evasive delivery methods such as QR codes, OneNote and Excel attachments, URL shorteners, cloud-hosted pages, and bot filtering. In one IRS-themed campaign, attackers targeted more than 29,000 users across 10,000 organizations and delivered a malicious ScreenConnect-based "Transcript Viewer" executable, showing how credential theft operations tied to Kratos also supported broader post-compromise access.