International Law Enforcement Operation Dismantles Kratos Phishing Infrastructure and Bypasses MFA Protections Worldwide

In a coordinated strike against the global cybercrime ecosystem, law enforcement agencies from Germany, the United States, and Indonesia have successfully dismantled the core infrastructure of Kratos, a sophisticated phishing-as-a-service (PhaaS) platform. This operation, announced on July 22, 2026, marks a significant victory for international cyber-investigators who describe Kratos as one of the most prolific and technically advanced criminal phishing kits in recent years. The crackdown involved the seizure of more than 200 servers globally and the arrest of the primary developer and operator in Indonesia, effectively neutralizing a platform that facilitated thousands of monthly attacks against corporate and individual targets.

The investigation was spearheaded by the Frankfurt Public Prosecutor’s Cybercrime Unit (ZIT) and Germany’s Federal Criminal Police Office (BKA). According to official statements, the operation targeted a highly organized "franchise" model of cybercrime where the developers of Kratos provided a turnkey solution for less-skilled criminals to launch high-impact phishing campaigns. By pulling the underlying infrastructure offline, authorities have disrupted a supply chain that investigators estimate supported approximately 1,800 paying "franchisees" who utilized the kit to orchestrate roughly 15,000 distinct phishing campaigns every month.

The Technical Sophistication of the Kratos Infrastructure

What set Kratos apart from legacy phishing kits was its ability to circumvent modern security protocols, specifically Multi-Factor Authentication (MFA). While traditional phishing focuses on harvesting usernames and passwords, Kratos utilized a technique known as Adversary-in-the-Middle (AiTM). Technical analysis conducted by cybersecurity firm ANY.RUN revealed that the kit offered two distinct operational modes for its users.

The first mode was a standard PHP-based page designed for simple credential harvesting. However, the second, more dangerous mode utilized a Node.js-based reverse proxy. This configuration acted as a bridge between the victim and the legitimate service—most frequently Microsoft 365. When a victim entered their credentials into the fraudulent site, the Kratos server would relay those details to the actual Microsoft login portal in real time. If the victim was prompted for an MFA code or a push notification, the kit would relay that prompt as well. Once the authentication was successful, Kratos would intercept and steal the resulting session cookie.

With this session cookie in hand, the attacker could bypass the login process entirely, effectively "walking past" the MFA gate without needing the user’s password or second factor again. This technique has rendered standard SMS or app-based MFA a much weaker defense than many organizations previously assumed, highlighting a critical shift in the threat landscape where session management has become as vital as password security.

A Global Business Model: Phishing-as-a-Service

The Kratos operation was not merely a technical tool but a comprehensive criminal enterprise. The BKA noted that the platform functioned as a subscription-based service. Potential attackers, referred to as "franchisees," could sign up through a dedicated website and a sophisticated Telegram-based shop. These interfaces allowed criminals to manage their accounts, organize their campaigns, and track their "success" rates in real time.

Payments for these services were conducted exclusively in cryptocurrency, providing a layer of anonymity for both the developers and the customers. Since late 2024, investigators estimate that the operators earned more than 300,000 euros in direct subscription fees. However, the secondary damage caused by the kit is estimated to be in the tens of millions of euros, as the stolen credentials and sessions were used to facilitate Business Email Compromise (BEC), financial fraud, and corporate espionage.

The reach of the Kratos platform was truly global. Law enforcement has identified victims in more than 30 countries, with the highest concentrations of targets located in Europe and the United States. The total number of victims is estimated to be in the hundreds of thousands, illustrating the massive scale at which these automated "franchise" kits can operate.

Targeted Campaigns and the Microsoft 365 Connection

Kratos was also tracked by Microsoft Threat Intelligence under the moniker "SneakyLog." Microsoft’s researchers had been monitoring the platform’s activities since early 2025, specifically its focus on harvesting credentials and session tokens from Microsoft 365 users. The platform was particularly active during high-stress periods for businesses, such as tax seasons.

In one notable campaign detected on February 10, 2026, the Kratos operators launched a highly targeted attack against approximately 100 organizations in the United States. These targets were primarily concentrated in the manufacturing, retail, and healthcare sectors—industries known for having complex supply chains and high volumes of financial transactions.

The lure involved tax-themed emails containing what appeared to be W-2 documents. However, these documents featured a personalized QR code for each recipient. This technique, often called "Quishing" (QR Phishing), is designed to move the attack from a monitored corporate computer to a victim’s personal mobile device, where security software may be less robust. Once scanned, the QR code led the victim to a fake Microsoft 365 login page powered by the Kratos AiTM infrastructure.

Official Responses and Strategic Implications

The successful takedown of Kratos has been hailed by law enforcement as a blueprint for future cybercrime disruptions. Carsten Meywirth, the head of the BKA’s cybercrime division, emphasized the importance of international cooperation in tackling high-tier criminal infrastructure. "This operation shows that even highly professional phishing infrastructures can be effectively combated when international partners work in concert," Meywirth stated.

Benjamin Krause, representing the ZIT, framed the operation as a shift toward a more "disruptive" law enforcement strategy. Rather than focusing solely on the long-term goal of individual prosecutions, the ZIT aims to dismantle the tools that enable mass-scale crime. By taking 200 servers offline and seizing the central management platform, law enforcement has forced 1,800 criminals to find new tools, significantly raising the cost of business for the "franchisees."

Cybersecurity experts suggest that the impact of this takedown will be felt for months. However, they also warn of the "Hydra effect" in cybercrime. While the central Kratos infrastructure is gone, the source code and the technical knowledge required to build similar AiTM kits remain in the wild. ANY.RUN’s analysis indicated that Kratos was often hosted on compromised WordPress sites and disposable domains, a decentralized structure that makes total eradication difficult.

Timeline of the Kratos Investigation and Takedown

• Late 2024: Initial development of the Kratos phishing kit begins; early versions of the PhaaS platform appear on dark web forums.
• Early 2025: Microsoft Threat Intelligence begins tracking the platform as "SneakyLog" following a surge in Microsoft 365 credential thefts.
• February 10, 2026: A major tax-themed "Quishing" campaign targets 100 organizations in the U.S., prompting intensified law enforcement scrutiny.
• Spring 2026: Joint task force involving BKA, ZIT, and the FBI begins mapping the Kratos server infrastructure across Europe and North America.
• July 20, 2026: Indonesian authorities, acting on intelligence from German and U.S. partners, arrest the alleged lead developer of Kratos.
• July 21, 2026: Law enforcement agencies execute simultaneous raids, seizing and shutting down over 200 servers associated with the platform.
• July 22, 2026: Official public announcement of the operation’s success.

Remediation and Defensive Measures for Organizations

In the wake of the takedown, Microsoft has begun notifying users and organizations whose data was identified within the seized Kratos databases. For organizations concerned about exposure, the BKA and cybersecurity firms have provided specific guidance.

The primary challenge with Kratos was its use of session cookies. If a user’s session was stolen via the AiTM proxy mode, a simple password reset is insufficient because the stolen session cookie remains valid. Security administrators are urged to revoke all active sessions for high-risk accounts and force a re-authentication. Furthermore, organizations are encouraged to transition from traditional MFA (like SMS or TOTP codes) to phishing-resistant authentication methods, such as FIDO2-based security keys or Windows Hello for Business, which are not susceptible to the proxy techniques used by Kratos.

Defenders can also hunt for specific Indicators of Compromise (IOCs) associated with the Kratos kit. Research from ANY.RUN highlighted that Kratos-generated login pages almost universally load two specific SVG assets: barr.svg and lg.svg. Additionally, the kit typically POSTs stolen data to endpoints named next.php or save.php. Monitoring for these specific file patterns on web servers and within network traffic can provide a high-confidence detection of Kratos activity.

The Future of Phishing-as-a-Service

The dismantling of Kratos represents a significant milestone, but it also underscores the evolving nature of the threat. The transition from simple credential harvesting to sophisticated session-theft proxies marks a new era in phishing. As long as there is a lucrative market for access to corporate environments, developers will continue to create platforms that lower the barrier to entry for cybercrime.

For now, the Kratos infrastructure is dormant, and its "franchisees" have been stripped of their primary weapon. The success of this operation serves as a reminder that while the digital landscape offers many places for criminals to hide, the combined resources of global law enforcement can still reach into the most complex networks to disrupt the machinery of modern cybercrime. The focus now shifts to the 1,800 customers who used the kit, as authorities continue to analyze the seized data to identify the individuals behind the thousands of campaigns that victimized people across the globe.