Kratos taken down, the phishing kit behind thousands of campaigns per month

German and US law enforcement dismantled Kratos’s infrastructure, a phishing-as-a-service platform considered among the most widely used in the world. The operation was led by the Frankfurt prosecutor’s office and the German Federal Criminal Police Office, with the cooperation of US authorities and the arrest in Indonesia of the alleged developer and administrator. Kratos was used to launch up to 15,000 campaigns per month and had a particular focus on stealing Microsoft 365 sessions and bypassing multifactor authentication. The takedown is important because it strikes at an industrialized criminal model: not a single isolated kit, but a platform that drastically lowers the barrier to entry for scammers. Removing the infrastructure can disrupt many ongoing campaigns, but the phishing services market tends to regenerate quickly. The case confirms how phishing remains one of the most effective tools against identities and corporate sessions.

Sources

• Police dismantle Kratos phishing platform behind 15,000 monthly campaigns — Help Net Security
• Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA — The Hacker News