Joint Operation Dismantles Kratos: The AiTM Phishing Kit That…

German, U.S., and Indonesian authorities have taken down over 200 servers powering the Kratos phishing kit. The code survives among roughly 1,800 customers, making the takedown a tactical disruption rather than a strategic eradication.

On July 20, 2026, the Frankfurt Public Prosecutor's Office for Cybercrime (ZIT) and Germany's Federal Criminal Police Office (BKA) announced they had taken down more than 200 servers at the heart of one of the world's most prolific phishing infrastructures. Indonesian authorities arrested the man identified as the kit's developer and operator. The operation, conducted with support from U.S. law enforcement, targeted the service known as Kratos — tracked by Microsoft Threat Intelligence as "SneakyLog" — but did not reach the code already distributed.

The takedown exposes a structural limit in the fight against phishing-as-a-service kits: shutting down the operator's servers does not sterilize the tools already in customers' hands.

Key Takeaways

The Kratos kit operated in two modes — PHP credential harvesting and Node.js reverse-proxy AiTM — running roughly 15,000 phishing campaigns per month against Microsoft 365.
The developer's arrest in Indonesia and the takedown of over 200 servers did not affect the roughly 1,800 paying customers, who retain the code.
The AiTM mode relays the authentication flow to Microsoft in real time, capturing the post-MFA session token and rendering traditional two-factor authentication ineffective.
ANY.RUN identified concrete technical indicators — the paired barr.svg and lg.svg files, with POST requests to next.php or save.php endpoints — that enable detection in 90% of cases with near-zero false positives.

How Kratos' Dual Engine Works

ANY.RUN reverse-engineered the kit, identifying two operational modes that subscribers chose based on the target. The first, implemented in PHP, harvested static credentials through spoofed login pages. The second, built on Node.js, executed an Adversary-in-the-Middle (AiTM) attack: a reverse proxy intercepted traffic between the user and Microsoft's authentication servers, relaying username, password, and the MFA flow in real time.

The technical result is the capture of a valid session token immediately after multi-factor authentication completes. The attacker gains persistent account access without having to compromise the second factor in the traditional sense — neither stealing nor cloning it. Ordinary MFA, based on TOTP or push notifications, becomes transparent to the proxy.

This architecture is not conceptually new, but its packaging as a commercial service lowers the barrier to entry for criminals with limited technical skills. Customers paid in cryptocurrency and registered via a dedicated site and a Telegram shop, in a model the BKA described as franchising.

The February 10 W-2 Campaign and Victim Geography

On February 10, 2026, Kratos operators launched a tax-themed campaign with customized QR codes on W-2 documents, hitting roughly 100 U.S. organizations across manufacturing, retail, and healthcare. Authorities estimate that since late 2024 the kit has generated hundreds of thousands of victims in more than 30 countries, concentrated in Europe and the United States. Each campaign could reach several thousand recipients.

Operator proceeds are estimated at over 300,000 euros since 2024. The infrastructure relied on ephemeral domains, compromised WordPress sites, and shared hosting alongside other AiTM kits — a distribution model that makes early tracking and blocking difficult.

Microsoft Threat Intelligence has tracked the same kit as "SneakyLog" since at least early 2025, indicating a prolonged operational life before German authorities launched the counter-action.

Why Shutting Down Servers Is Not Enough

The takedown struck the central infrastructure but not the roughly 1,800 paying customers or the kit code already in their possession. This distinction is crucial: in a PhaaS model, the product is software, not just a hosting service. Customers can replicate the infrastructure on new servers, rebrand, and relaunch the same tool under a different name — a pattern already observed with previous AiTM kits.

Carsten Meywirth, head of the BKA's cybercrime division, stated that "even highly professional phishing infrastructures can be effectively combated." Benjamin Krause of the ZIT described the operation as "disruptive." Both statements emphasize tactical success; neither the sources nor the authorities have claimed the kit has been eradicated.

Microsoft is notifying affected users. For victims of the credential-harvesting mode, the source indicates that password resets and MFA verification are sufficient. For those hit by the AiTM mode, session revocation is required; high-value accounts should be migrated to phishing-resistant authentication methods such as FIDO2/WebAuthn.

Immediate Actions for Security Teams

For security teams, the source suggests four priority actions based on available data.

First: activate detection for the ANY.RUN indicators — the paired barr.svg and lg.svg files loaded together, with POST requests to next.php or save.php endpoints — which demonstrated 90% recall with near-zero false positives. These artifacts are specific and recognizable in web traffic.

Second: check for suspicious Microsoft 365 sessions in the organization, especially following phishing campaigns received in previous months. The AiTM mode leaves valid tokens that are not automatically invalidated by a password change.

Third: for accounts with access to critical data, evaluate migration to FIDO2/WebAuthn. MFA based on TOTP or push notifications does not withstand an AiTM proxy that relays the flow in real time; phishing-resistant authentication based on asymmetric cryptography bound to the domain blocks this vector.

Fourth: look for emails with tax-themed QR codes or W-2 documents, particularly those received around February 10, 2026, and correlate any clicks with authentication log anomalies.

"Even highly professional phishing infrastructures can be effectively combated." — Carsten Meywirth, BKA

The Code Survives: The Criminal Franchising Problem

The operation against Kratos illustrates a growing tension in global cybersecurity: takedowns are excellent for disrupting a service's growth, but poor at extinguishing the threat when the product is copyable code. The subscription model with cryptocurrency payment and Telegram distribution has created a network of independent "franchisees" who no longer depend on the originator.

The kit will continue to circulate, likely under other names. The challenge for defenses is no longer just identifying infrastructure, but recognizing the behavior — the technical pattern of the AiTM reverse proxy — regardless of domain or branding. ANY.RUN's indicators offer a concrete starting point, but require SOCs to integrate detection into operational workflows.

Frequently Asked Questions

Why didn't MFA protect Kratos victims?

Traditional MFA (TOTP, SMS, push notification) verifies the user's identity but not the integrity of the channel. Kratos' AiTM reverse proxy sits between the user and Microsoft, relaying the full flow: the legitimate server sees a valid login, the user sees an authentic page, and the attacker captures the session token issued after MFA is satisfied. Only phishing-resistant authentication (FIDO2/WebAuthn) binds cryptography to the domain and blocks this relay.

Can Kratos customers continue to attack?

The dossier does not specify post-takedown activity, but highlights that customers were not affected by the operation and retain the code. The technical capacity to continue exists; actual operational continuity depends on factors not documented in the source, such as the availability of new hosting infrastructure and the willingness to assume elevated risk after the developer's arrest.

Is there an official BKA/ZIT statement available directly?

The dossier does not contain a direct URL to a BKA or ZIT press release. Data on official statements comes from The Hacker News article, which reports the Meywirth and Krause quotes without linking the primary document.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references