Loading story…
German authorities, working with the United States and Indonesia, dismantled the core infrastructure of Kratos, a phishing-as-a-service platform described as one of the world’s most widely used criminal phishing services. Investigators seized or neutralized more than 200 servers and arrested the alleged developer and technical administrator in Indonesia, a move authorities said rendered the service inoperable. The action was carried out under Operation Olympus Blade, and the FBI took control of Kratos-linked domains to support follow-on investigation and customer identification.
Kratos supplied Microsoft-themed phishing pages designed to steal credentials and session cookies, allowing attackers to hijack accounts and bypass multi-factor authentication. Authorities said the platform was used by roughly 1,800 criminal customers to launch about 15,000 phishing campaigns per month against victims in at least 35 countries, with organizations in the United States and Europe—particularly in manufacturing, retail, healthcare, and education—among the main targets. Investigators estimate the operation generated more than €300,000 since 2024.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Trend Micro said its TrendAI team began providing threat intelligence and infrastructure analysis to Germany's BKA in 2025 to support the investigation into the Kratos phishing-as-a-service platform. The assistance helped inform the later Operation Olympus Blade disruption.
Authorities arrested the alleged developer and technical administrator of Kratos in Indonesia as part of the takedown. Investigators linked the platform to roughly 1,800 criminal customers running about 15,000 phishing campaigns per month.
German and U.S. authorities, with support from Indonesia, dismantled the core infrastructure behind the Kratos phishing-as-a-service platform. The operation included seizing or neutralizing more than 200 servers, and authorities said the action rendered the service inoperable.
As part of Operation Olympus Blade, the FBI took control of Kratos domains to support the ongoing investigation and help identify the platform's customers. This detail was reported alongside the broader law enforcement disruption of the service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcetrendmicro.com
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourcebka.de
Open sourceany.run
Open sourcebka.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German authorities, supported by the United States and Indonesia, dismantled the main infrastructure behind the **Kratos** phishing-as-a-service platform and reportedly neutralized more than 200 servers, while Indonesian authorities arrested the alleged developer and technical administrator. Investigators said the kit had been used by more than 1,800 criminal groups to launch roughly 15,000 phishing campaigns each month across more than 30 countries, primarily targeting organizations in the US and Europe. Also tracked as **SneakyLog** and **Sneaky 2FA**, Kratos was designed to steal credentials and session cookies through convincing Microsoft-themed phishing pages, enabling attackers to bypass multifactor authentication and compromise Microsoft 365 accounts. Threat reporting had previously tied Kratos to broad phishing waves using lures themed around tax documents, IRS notices, CPA requests, and cryptocurrency tax forms, with victims spanning financial services, healthcare, education, retail, manufacturing, technology, law firms, schools, and SMBs. Campaigns impersonated services including **SharePoint**, **OneDrive**, **Microsoft Forms**, **Canva**, **Tilda**, and **Adobe**, and used evasive delivery methods such as QR codes, OneNote and Excel attachments, URL shorteners, cloud-hosted pages, and bot filtering. In one IRS-themed campaign, attackers targeted more than 29,000 users across 10,000 organizations and delivered a malicious **ScreenConnect**-based "Transcript Viewer" executable, showing how credential theft operations tied to Kratos also supported broader post-compromise access.
Jul 21, 2026
INTERPOL, the Algerian National Police, and Group-IB dismantled **SniperDZ**, a phishing-as-a-service ecosystem that operated for nearly a decade and enabled large-scale credential theft, personal-data harvesting, and browser-based fraud. Investigators said the operation distributed about **80 free phishing templates** through Telegram and Facebook channels, impersonated roughly **30 major online platforms**, and relied on more than **20,000 domains** to host fake login pages. Group-IB attributed the infrastructure to a threat actor known as **Guedz** after analyzing tutorial videos that exposed an administrator panel and backend email addresses; Algerian authorities then arrested the suspect and seized hardware containing phishing code and malicious scripts. Researchers said SniperDZ also functioned as a centralized push-notification abuse platform used heavily across the Middle East and North Africa. Campaigns used fake Facebook and Instagram posts impersonating politicians, public figures, and telecom providers to lure victims with offers such as free mobile data, compensation, and subsidy programs, then redirected them through link shorteners and attacker-controlled chains to phishing pages that requested browser notification permissions. Group-IB linked multiple campaigns to the same ecosystem through a recurring **VAPID public key** and infrastructure hosted on **Horizon IS**, and documented cloaking, browser-history manipulation, and tab-under techniques used to evade detection while monetizing victims through unsolicited ads, scams, and malicious content. The takedown formed part of **Operation Ramz**, which spanned 13 countries and resulted in **201 arrests**, **53 malicious servers seized**, and **3,867 compromised endpoints and victims identified**.
Jun 29, 2026
An international law enforcement campaign under **Operation PowerOFF** has repeatedly dismantled major **DDoS-for-hire** or **booter/stresser** services, seizing domains and infrastructure, arresting alleged administrators, and targeting customers across dozens of countries. In one major phase, authorities shut down **48 services** and arrested **seven** suspected operators after U.S. charges tied defendants to platforms including `Booter.sx`, `Astrostress.com`, and `SecurityTeam.io`; officials said one seized service alone had been used in more than **30 million attacks**. A later coordinated action involving the United States and about **20 partner countries** seized **53 domains**, made **four arrests**, executed **25 search warrants**, and sent more than **75,000 warning messages** to users, while also removing more than **100 URLs** advertising booter sites. The crackdown builds on earlier takedowns such as the seizure of **Webstresser.org**, which Europol described as the world’s largest DDoS-for-hire marketplace, with more than **136,000 registered users** and **4 million attacks** recorded before it was dismantled. Investigators said these services marketed themselves as legitimate network testing tools but were used to launch attacks against **schools, government agencies, gaming platforms, critical infrastructure, Department of Defense resources, businesses, and individuals**, often for as little as **EUR 15 per month**. Authorities also expanded disruption efforts beyond arrests and seizures by placing warning ads in search results and reaching users through cryptocurrency payment channels, underscoring a sustained multinational effort to raise the cost of operating and buying low-barrier DDoS attack services.
Jun 29, 2026