Kratos Phishing Kit Dismantled: 200 Servers Seized, but AiTM…

German, U.S., and Indonesian authorities took down the Kratos phishing kit, seizing over 200 servers and arresting the alleged developer in Indonesia. However, the AiTM source code remains in the hands of roughly 1,800 paying customers, turning a controlled PhaaS platform into a public criminal asset poised to re-emerge under new names.

On July 20, 2026, German law enforcement (BKA and ZIT), U.S., and Indonesian authorities took more than 200 servers offline and arrested the alleged developer of Kratos in Indonesia. Kratos was one of the world's most widely distributed phishing kits. The takedown produced a dangerous side effect: the source code remains with approximately 1,800 paying customers, transforming a controlled PhaaS platform into a public criminal asset ready to resurface under different names.

Key Takeaways

Over 200 servers seized and arrest in Indonesia: the alleged Kratos developer is in custody, but the AiTM code still circulates among customers
Dual-mode architecture: PHP mode for traditional credential harvesting and advanced Node.js reverse-proxy mode implementing AiTM against Microsoft 365, bypassing TOTP/SMS/push-based MFA
~1,800 paying customers generated ~15,000 phishing campaigns per month with estimated revenue exceeding €300,000 since 2024, per The Hacker News; GBHackers extends the revenue estimate to "over €300,000" from 2020
Microsoft Threat Intelligence tracks the same kit as "SneakyLog" from at least early 2025; a documented campaign on February 10, 2026 hit ~100 organizations in manufacturing, retail, and healthcare

The Takedown and Its Hydra Effect: When Dismantling Fuels Spread

The seizures targeted the shared hosting infrastructure, disposable domains, and compromised WordPress sites Kratos used to distribute its phishing pages. The economic model, structured as a franchise with cryptocurrency payments and account management via a dedicated site and Telegram shop, had drastically lowered the technical barrier for low-skill criminals.

However, the core problem is not the servers. ANY.RUN reverse-engineered the kit and identified an advanced Node.js mode that implements a real-time reverse proxy: Microsoft 365 authentication traffic is relayed through the attacker's infrastructure, which captures session cookies after MFA completion. This mechanism, known as Adversary-in-the-Middle, renders two-factor authentication based on TOTP, SMS, or push notifications ineffective.

"Even highly professional phishing infrastructures can be effectively combated" — Carsten Meywirth, head of BKA cybercrime division

Meywirth's statement underscores the operational effectiveness of the takedown, but a second quote from the same dossier reveals the strategic tension. Benjamin Krause of ZIT Frankfurt described the operation as a "disruptive approach of dismantling a criminal service outright rather than only charging the people behind it." The disruptive approach, however, did not neutralize the client code.

How the AiTM Attack Works and Why It Bypasses Traditional MFA

The Kratos kit operated in two distinct modes. The first, static and less sophisticated, used PHP pages for direct credential harvesting: a classic harvesting approach that does not defeat MFA but remains effective against users who have not enabled it. The second mode, which made Kratos/SneakyLog particularly dangerous, leverages a Node.js reverse proxy that interposes itself between the victim and Microsoft servers.

When the user enters email and password on the phishing page, the proxy forwards the credentials to the legitimate Microsoft server. The user completes the second factor normally — TOTP code, SMS, or push confirmation — and the proxy captures the resulting session cookie. The attacker can then replay that session without ever possessing the permanent credentials, and a password reset does not invalidate the stolen cookie.

ANY.RUN documented specific indicators of compromise with 90% recall and near-zero false positives: the pair of files barr.svg and lg.svg loaded together, and POST requests to the next.php or save.php endpoints. These IoCs enable retrospective hunting in corporate networks, but their effectiveness depends on historical log visibility.

Immediate Actions

Explicitly revoke all active Microsoft 365 sessions and force re-authentication, an operation that invalidates potentially stolen AiTM cookies; a simple password reset is not sufficient
Check historical logs for the presence of the barr.svg and lg.svg file pair, or POST calls to the next.php and save.php endpoints, to identify past undetected exposures
Accelerate migration to phishing-resistant MFA based on FIDO2/WebAuthn, resistant by design to AiTM relay because the protocol does not transmit replicable credentials
Monitor for the emergence of new kits reusing the Kratos/SneakyLog codebase with different domain names or branding, given that ~1,800 former customers possess the code

The Numbers and Discrepancies to Note

The Hacker News reports approximately 1,800 paying customers, ~15,000 phishing campaigns per month, and revenue exceeding €300,000 since 2024, with victims numbering in the hundreds of thousands since late 2024 across more than 30 countries. GBHackers confirms the customer and campaign figures, but specifies ~850 identified victims in 35 countries and extends the revenue estimate to "over €300,000" from 2020 to 2024. The discrepancy in victims — hundreds of thousands versus ~850 identified — likely reflects the difference between phishing attempts and verified compromises.

The campaign documented on February 10, 2026, active against ~100 organizations in manufacturing, retail, and healthcare primarily in the United States, used tax-themed emails with personalized QR codes pointing to fake Microsoft 365 login pages. This operational specificity demonstrates that Kratos was not a generic kit, but a platform capable of targeted customization by sector and geography.

The Kratos Paradox: Successful Takedown, Legacy Risk

The BKA stated that "Kratos-powered campaigns cannot continue" in their current centralized format. The technical reading, however, suggests a different dynamic. With the code circulating among ~1,800 franchisees, each with varying technical skills but possessing the complete AiTM blueprint, the takedown eliminated the economic collection point but not the technical reproduction capability.

The cybersecurity sector faces an uncomfortable verification: infrastructure seizure operations without customer follow-through can accelerate a kit's spread more than reduce it. Kratos becomes a case study of a "hydra paradox" — cutting off one head generates many more if the shared brain survives. For enterprise defenses, the operational lesson is that resilience against AiTM does not lie in monitoring phishing domains — which change daily — but in adopting authentication protocols that make relay technically impossible.

Information verified against cited sources and current as of publication.

Sources

Sources and references