German authorities, supported by US and Indonesian law enforcement, have dismantled the primary infrastructure of the Kratos phishing-as-a-service (PhaaS) kit. The operation led to the arrest of the alleged developer and technical administrator in Indonesia.
Officials from Frankfurt am Main's Central Office for Combating Internet Crime (ZIT) and the Federal Criminal Police (BKA) described Kratos as a highly prevalent and dangerous PhaaS offering. It enabled cybercriminals, even those with limited technical skills, to deploy convincing Microsoft-themed phishing pages designed to harvest credentials, including passwords and session cookies, thereby bypassing multi-factor authentication (MFA).
The Kratos kit facilitated phishing campaigns that targeted hundreds of thousands of victims across more than 30 countries. The criminal enterprise behind Kratos is estimated to have generated over €300,000 (approximately $342,000) since 2024. Authorities believe more than 1,800 criminal groups utilized Kratos, which was responsible for approximately 15,000 phishing campaigns each month. Each individual campaign had the potential to affect thousands of recipients globally.
The law enforcement action neutralized over 200 servers associated with the Kratos infrastructure. While specific methods for the takedown were not detailed, previous operations of this nature have involved legal warrants issued to hosting providers and collaboration with internet service providers (ISPs) to null-route or sinkhole malicious traffic.
Dr. Benjamin Krause, head of the ZIT, emphasized the effectiveness of disruptive law enforcement in dismantling criminal online services and enhancing cybersecurity. Carsten Meywirth, head of the BKA's cybercrime department, issued a warning to cyber actors, stating that professional phishing infrastructures will be consistently combated.
While German authorities referred to the PhaaS kit exclusively as Kratos, open-source intelligence has linked it to products previously marketed under names such as SneakyLog and Sneaky 2FA. Microsoft, which also identified Kratos as SneakyLog, indicated that SneakyLog entered the phishing kit market in early 2025. However, other security researchers suggest the first signs of Kratos emerged in January 2026, and some reports do not connect it to SneakyLog or Sneaky 2FA, instead proposing an evolution from a family of commercial trojans and infostealers.
Initially, German authorities mentioned only fake Microsoft authentication pages as templates offered by Kratos. However, Microsoft previously reported that SneakyLog was used to generate phishing campaigns targeting US citizens with fraudulent W-2 tax forms. More recently, as of July 16, security firms have observed Kratos offering lures themed around various services, including SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and Adobe.
The primary targets of Kratos customers are largely concentrated in the US and Europe. In the US, Microsoft identified manufacturing, retail, and healthcare as key target industries. In Europe, attacks have been observed against industrial organizations, law firms, polytechnic institutions, schools, and small-to-medium businesses (SMBs).
