Kratos Dismantled: AiTM Code Remains in Hands of 1,800 Criminals

German and U.S. authorities seized over 200 servers linked to the Kratos phishing-as-a-service kit, but the source code still circulates among roughly 1,800 paying customers. The business model survives the takedown, turning a dismantled infrastructure into a reproducible playbook for future attacks.

On July 22, 2026, German and U.S. law enforcement announced the seizure of more than 200 servers tied to Kratos, a phishing-as-a-service kit that stole Microsoft 365 sessions by bypassing multi-factor authentication. The alleged developer, an Indonesian national, was arrested by local authorities. The paradox of the operation is technical before it is judicial: the kit's source code remains in circulation among approximately 1,800 paying customers, turning a dismantled infrastructure into a reproducible manual for future attacks.

Key Takeaways

The Kratos kit operated in dual mode: passive credential harvesting via PHP or active post-MFA session theft via a Node.js reverse proxy using an adversary-in-the-middle technique
Microsoft Threat Intelligence tracks the same kit under the alternate name "SneakyLog," active since Q1 2025
The February 10, 2026 campaign used tax-themed emails with personalized QR codes targeting roughly 100 U.S. organizations
Technical indicators identified by ANY.RUN — the barr.svg and lg.svg assets with POST requests to next.php/save.php — deliver 90% recall with near-zero false positives

How the AiTM Session Theft Worked

Kratos implemented a Node.js reverse proxy that intercepted the Microsoft 365 authentication flow in real time. The victim entered credentials and completed MFA on a cloned page; the proxy forwarded credentials to the legitimate Microsoft server, received the validated session token, and duplicated it for the kit operator. The stolen session remained active regardless of any subsequent password change by the victim, because the validated token was not automatically invalidated.

A PHP fallback mode enabled simpler collection: credentials captured without live interaction with Microsoft infrastructure. This dual architecture lowered the technical skill threshold for the service's customers.

The Franchise Model and the Numbers Behind the Operation

According to the cited dossier, Kratos functioned as a franchise platform with cryptocurrency payments, registration via a dedicated site, and a Telegram shop channel. Customers were termed "franchisees" by the Bundeskriminalamt (BKA). The paying base numbered approximately 1,800 actors. Operational estimates indicate roughly 15,000 phishing campaigns per month. Estimated revenue since 2024 exceeds €300,000.

Documented victims number in the hundreds of thousands since late 2024, distributed across more than 30 countries. The seizure of over 200 servers represents a significant infrastructure disruption, but not of the code that powered it.

"Disruptive approach of dismantling a criminal service outright rather than only charging the people behind it"
— Benjamin Krause, ZIT Frankfurt

Why This Matters

The Kratos takedown demonstrates that criminal infrastructures can be identified and disrupted, but not erased. The kit's code still circulates; ANY.RUN reports that Kratos ran on disposable domains, compromised WordPress instances, and shared hosting alongside other AiTM kits. This architectural modularity makes replication immediate for anyone who acquired the software package before July 22.

The dossier does not specify whether Microsoft revoked the identified compromised sessions. The current status of investigations into the 1,800 service customers also does not emerge: the documented arrest concerns only the Indonesian developer, not the distribution network.

The BKA highlighted a relevant operational characteristic: the seized servers were distributed to complicate geographic correlation, but the presence of shared static assets (barr.svg, lg.svg) and fixed endpoints (next.php, save.php) enabled stable detection indicators over time.

The SneakyLog Case and Microsoft's Trail

Microsoft Threat Intelligence has tracked the same kit under the alternate name "SneakyLog," documenting its activity since Q1 2025. The convergence of designations — Kratos for German law enforcement, SneakyLog for Microsoft — confirms that the intelligence ecosystem is mapping the same operators through different taxonomies. No infrastructural overlaps emerge linking Kratos to other known AiTM kits beyond this dual labeling.

The February 10, 2026 campaign remains the most precisely documented case: tax-themed emails referencing W-2 documents, personalized QR codes per recipient, targeting roughly 100 U.S. organizations. The QR code was designed to evade traditional text-link filters.

Why the Business Model Survives the Takedown

The dismantling operation struck the infrastructure, not the market. Kratos code requires no proprietary servers: it runs on any Node.js instance with reverse-proxy capability. The 1,800 franchisees can replicate the operation with disposable hosting, making the kit a low-cost blueprint for criminals with limited technical skills. This is the central paradox: seizing servers does not dismantle the economic model.

Carsten Meywirth, head of the BKA's cybercrime division, framed the assessment as follows: "that even highly professional phishing infrastructures can be effectively combated." The statement declares an operational result, not a strategic conclusion. Combat effectiveness measured by server seizure does not automatically translate into reduced risk for end users.

The brief does not document specific remedial measures or explicit operational recommendations from authorities. The source does not specify the nature of exfiltrated data beyond session tokens, nor distinguish between victims whose sessions were actually used and victims whose credentials were only captured in PHP mode.

The investigation remains open on an attribution point: the exact identity of the arrested developer is not reported, and the actual amount of source code recovered during the operation is unknown. These limits condition the assessment of the takedown's long-term impact.

Information is based on the cited advisory and current as of publication.

Sources

Information is based on the cited source and current as of publication.

Sources

Sources and references

thehackernews.com