International operation takes down Kratos phishing service
German authorities dismantle cybercrime network active in 30 countries
1Kratos' downfall
German authorities, with support from the US and Indonesia, neutralized the core infrastructure of the Kratos phishing-as-a-service kit. Frankfurt's ZIT and BKA teams described Kratos as one of the most prevalent and dangerous phishing tools available. The alleged 'developer and technical administrator' was arrested in Indonesia during the operation.
2Widespread impact
The Kratos kit enabled low-skilled cybercriminals to bypass multi-factor authentication using convincing Microsoft-themed phishing pages. Targeting victims across 30+ countries, the service was linked to over 1,800 criminal groups, facilitating approximately 15,000 phishing campaigns monthly. Each campaign potentially affected thousands globally.
3Financial scale
Operators behind Kratos reportedly earned over €300,000 since 2024. Authorities emphasized that single campaigns could harm thousands worldwide. The takedown operation disabled more than 200 servers supporting the criminal infrastructure across multiple jurisdictions.
4Methods and collaboration
Authorities employed legal warrants to infrastructure providers and coordinated with ISPs to block suspicious traffic. Dr. Benjamin Krause from Frankfurt Prosecutor's Office stated their 'disruptive law enforcement approach works,' while BKA's cybercrime chief highlighted their capability to dismantle even sophisticated phishing operations.
5Identity confusion
Kratos was also known as SneakyLog and Sneaky 2FA in underground markets. Beyond Microsoft templates, it offered lures mimicking SharePoint, OneDrive, Canva and Adobe. While Microsoft dates its emergence to early 2025, KnowBe4 reports first sightings in January 2026. Consensus exists about primary targets being in the US and Europe.
6Sectoral consequences
US manufacturing, retail and healthcare sectors were primary targets, while European attacks focused on industrial organizations, law firms, technical schools and SMBs. BKA's 'phishing won't go unpunished' message signals continued aggressive stance against cybercrime. This operation underscores international cooperation's critical role in combating digital threats.