Authorities Dismantle Kratos Phishing Kit, but the Code Lives On…

German and U.S. law enforcement seized over 200 servers and took down the Kratos phishing-as-a-service platform on July 21, 2026, while Indonesian authorities arrested the alleged developer. However, roughly 1,800 paying customers—described by the BKA as "franchisees"—retain the kit's code and operational tools, creating an immediate risk of copycat proliferation. The AiTM platform targeted Microsoft 365 and bypassed MFA via a Node.js reverse proxy that captured post-authentication session tokens.

German and U.S. law enforcement have seized more than 200 servers and dismantled the core infrastructure of Kratos, one of the most widely distributed phishing-as-a-service kits tracked in recent years. The operation, announced jointly by the German Federal Criminal Police Office (BKA) and the Central Office for Cybercrime in Frankfurt (ZIT), took the platform offline on July 21, 2026. Indonesian authorities simultaneously arrested the man identified as the kit's developer and operator.

The paradox emerging from the dossier is clear: the takedown struck the criminal cloud infrastructure, not the distributed software. Roughly 1,800 paying customers, described by the BKA as "franchisees," retain the code and operational tools. The risk of copycat proliferation is immediate and structural.

Key Takeaways

More than 200 Kratos servers were seized in a joint German-U.S. law enforcement operation, with the developer arrested in Indonesia.
The service counted roughly 1,800 paying customers running approximately 15,000 phishing campaigns per month, with estimated revenue exceeding €300,000 since 2024.
ANY.RUN reverse-engineered two technical modes: passive credential harvesting via PHP, and active relay via a Node.js reverse proxy that captures post-MFA sessions.
Microsoft Threat Intelligence tracked the same kit as "SneakyLog," active against Microsoft 365 since at least early 2025.

The Franchise Model That Multiplies Risk

Kratos operated on an economic model that drastically lowered the barrier to entry for low-skill threat actors. Customers paid in cryptocurrency and registered through a dedicated site and a Telegram shop. The BKA labeled them "franchisees" to emphasize the structure: each customer received the kit itself, not just access to a centralized service.

This distinction is decisive. The takedown shut down the core servers but did not touch the roughly 1,800 customers or the code they already possess. The source does not specify remedial measures to prevent independent reuse of the software. The distributed structure turns every former franchisee into a potential autonomous operator, with minimal adaptation curve.

"that even highly professional phishing infrastructures can be effectively combated" — Carsten Meywirth, head of BKA cybercrime division

The Kit's Two Technical Modes: Harvesting and AiTM

ANY.RUN reverse-engineered the kit, identifying two operational modes from which operators could choose. The first is a PHP page that performs pure credential harvesting: the user enters a username and password, the system captures them, and the actor retrieves them. This mode is vulnerable to MFA, which blocks subsequent access.

The second mode is more sophisticated and forms the core of the threat against Microsoft 365. It is a Node.js reverse proxy that relays the login to Microsoft in real time. The user authenticates legitimately, passes MFA, and the proxy captures the resulting session. The stolen session token enables full access, effectively bypassing multi-factor authentication by design.

Microsoft Threat Intelligence identifies the same kit as "SneakyLog," active against Microsoft 365 since at least early 2025. The convergence between independent ANY.RUN analysis and vendor intelligence confirms the platform's technical maturity.

The February 10 Tax Campaign and the barr.svg Indicator

On February 10, 2026, Kratos operators sent tax-themed emails to approximately 100 organizations, primarily in the United States, across the manufacturing, retail, and healthcare sectors. Each email contained a W-2 document with a personalized QR code for the recipient, redirecting to a fake Microsoft 365 login.

ANY.RUN identified specific indicators of compromise with 90% recall and near-zero false positives. The kit's login pages almost always load the paired assets barr.svg and lg.svg, then exfiltrate stolen credentials via POST to endpoints such as next.php or save.php. This pattern constitutes a stable technical fingerprint, useful for detection even if the kit rebrands.

Kratos ran on disposable domains, compromised WordPress sites, and shared hosting alongside other AiTM kits. The source emphasizes that this configuration can reappear under a new name, with the same technical indicators.

Why It Matters

The brief does not document specific remedial measures beyond those indicated by Microsoft for already-compromised users. The source does not specify whether law enforcement has initiated preventive notifications to potential targets, nor whether active copycat campaigns exist at the time of writing.

The dossier leaves operational questions open. The exact identity of the arrested Indonesian national is not reported. The precise date of the joint BKA/ZIT announcement is indicated only as "Monday." The exact number of victims remains an estimate: hundreds of thousands since late 2024, across more than 30 countries, concentrated in Europe and the U.S. The source does not quantify the extent of potential code reuse by the roughly 1,800 former customers.

The paradox of law enforcement success lies here: dismantling the criminal cloud does not eliminate the distributed software. For defenders, the problem shifts from tracking a centralized service to monitoring dozens of independent operators sharing the same technical DNA.

FAQ

What is an AiTM kit and why does it bypass MFA?: An adversary-in-the-middle reverse proxy relays legitimate authentication to the real server, capturing the post-authentication session. MFA is executed correctly by the user, but the session token ends up in the actor's hands.
Can the roughly 1,800 customers reactivate campaigns immediately?: The source does not document confirmed reactivations. It does document that the code persists with customers and that the technical configuration can reappear under a new name, making the risk structurally plausible.
Has Microsoft mitigated the threat?: Microsoft is notifying affected users. The source distinguishes two responses: password reset and MFA verification for harvesting victims; session revocation and transition to phishing-resistant sign-in for victims of the AiTM mode.

Sources

Information is based on the cited source and current as of publication.

Sources

Sources and references

thehackernews.com