Police Take Down Kratos Phishing Kit Targeting Microsoft 365 Sessions
German and US authorities dismantled the Kratos phishing kit, which bypassed multi-factor authentication.
1Neutralization of the Kratos Phishing Kit
German and US authorities disabled the core infrastructure of the Kratos phishing kit, one of the most widely used criminal tools globally. This kit could steal Microsoft 365 sessions and bypass multi-factor authentication. The German Federal Criminal Police (BKA) shut down over 200 servers to halt the operation.
2How the Phishing Kit Operated
Kratos could operate in two modes: a simple PHP page that only harvested credentials, and a Node.js reverse proxy that stole live sessions in real-time. The second mode bypassed MFA, raising questions about its reliability. This adversary-in-the-middle technique made MFA less effective than it appears.
3Operation Structure and Impact
Kratos operated like a franchise, with around 1,800 customers running approximately 15,000 phishing campaigns monthly. The number of victims reached hundreds of thousands across more than 30 countries. Operators earned over €300,000 since 2024, highlighting the scale of the criminal enterprise.
4Microsoft's Findings
Microsoft Threat Intelligence identified Kratos as SneakyLog, a phishing-as-a-service platform active since at least early 2025. For example, in February 2026, attackers sent tax-themed emails with W-2 documents containing QR codes leading to fake Microsoft 365 login pages.
5Solutions for Victims
Microsoft is notifying affected users. For those with only credentials stolen, a password reset and MFA check suffice. However, if live sessions were stolen, the session must be revoked. High-value accounts are advised to switch to phishing-resistant sign-in methods for better security.
6Significance of the Operation
This operation demonstrated that even highly professional phishing infrastructures can be dismantled. German authorities proved the success of their strategy to directly disable criminal services. However, the 1,800 customers and the kit code remain active, posing a lingering threat.
Original article: The Hacker News — Kratos Phishing Kit İle Microsoft 365 Oturumları Çalındı