Kratos phishing-as-a-service kit loses its battle with international law enforcement

Security

Alleged developer arrested in Indonesia after more than 200 servers slain

German authorities say they have neutralized the main infrastructure supporting the Kratos phishing-as-a-service (PhaaS) kit following an operation supported by the US and Indonesia.

Officers from Frankfurt am Main's Central Office for Combating Internet Crime (ZIT) and the Federal Criminal Police (BKA) described Kratos as one of the most widespread and dangerous PhaaS kits on the market.

In Indonesia, authorities said they arrested the Kratos kit's alleged "developer and technical administrator." The announcement of Kratos's takedown did not mention whether any other individuals are being pursued.

According to the ZIT and BKA, Kratos allowed low-skill cybercrims to harvest credentials, including passwords and session cookies, to bypass MFA by providing them with convincing Microsoft-themed phishing pages.

Criminals using Kratos phishing pages targeted hundreds of thousands of victims across more than 30 countries, while the operation behind the kit allegedly earned more than €300,000 ($342,000) since 2024.

More than 1,800 criminal enterprises are estimated to have used Kratos, which was responsible for around 15,000 phishing campaigns per month.

"Each individual campaign had the potential to harm several thousand recipients worldwide," the German authorities said in a statement.

The operation neutralized more than 200 servers, according to the ZIT and BKA, although the latter declined to explain how.

Methods used in previous takedowns included handing legal warrants to infrastructure providers, such as Kratos's chosen hosting company, and working with ISPs to null-route or sinkhole traffic associated with suspect IP addresses.

Dr Benjamin Krause, head of the ZIT at the Frankfurt am Main Public Prosecutor's Office, said, "Our approach of disruptive law enforcement works: In addition to the primary task of identifying and prosecuting the accused, we have once again succeeded in dismantling a criminal online service and thus contributing to greater cybersecurity."

Carsten Meywirth, head of the cybercrime department at the BKA, added: "Anyone who steals login credentials online using fake websites shouldn't feel safe. The success against the Kratos phishing kit shows that even highly professional phishing infrastructures can be effectively combated. 

"This is pioneering work and a clear signal to other cyber actors – phishing will not go unpunished and will be consistently fought by the BKA."

Many names, same focus

German authorities referred to the PhaaS kit only as Kratos, although open source reporting has tied it to products previously sold under names such as SneakyLog and Sneaky 2FA.

Similarly, the ZIT and BKA mentioned only fake Microsoft authentication pages among the templates offered by Kratos. Microsoft, meanwhile, reported earlier this year that SneakyLog had been used to generate phishing campaigns targeting US citizens with fake W-2 tax forms.

As recently as July 16, security shops such as Heal Security reported that Kratos offered customers lures themed around various websites, including SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and more.

KnowBe4 added Adobe lures to that list with its own investigation in February, which also raised uncertainty about when the kit first hit the market.

Microsoft, which said Kratos was also known as SneakyLog, believes the latter entered the phishing kit market as of early 2025, although KnowBe4 said the first signs of Kratos only emerged in January 2026.

Muddying the picture further, KnowBe4 did not mention SneakyLog or Sneaky 2FA as part of Kratos's past. The security shop said instead that it evolved from a previous life as a family of commercial trojans and infostealers.

One thing that most open source reports agree on, however, is that the targets of the phishing kit's customers are based primarily in the US and Europe.

Microsoft identified manufacturing, retail, and healthcare as the main target industries in the US, while in Europe, industrial organizations, law firms, polytechnic institutions, schools, SMBs, and others have all been attacked, according to ANY.RUN. ®