# International operation takes down Kratos phishing service German authorities dismantle cybercrime network active in 30 countries - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-07-21 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/a78c541b-725c-4f52-a878-08c6304c8ecc ## Kratos' downfall German authorities, with support from the US and Indonesia, neutralized the core infrastructure of the Kratos phishing-as-a-service kit. Frankfurt's ZIT and BKA teams described Kratos as one of the most prevalent and dangerous phishing tools available. The alleged 'developer and technical administrator' was arrested in Indonesia during the operation. ## Widespread impact The Kratos kit enabled low-skilled cybercriminals to bypass multi-factor authentication using convincing Microsoft-themed phishing pages. Targeting victims across 30+ countries, the service was linked to over 1,800 criminal groups, facilitating approximately 15,000 phishing campaigns monthly. Each campaign potentially affected thousands globally. ## Financial scale Operators behind Kratos reportedly earned over €300,000 since 2024. Authorities emphasized that single campaigns could harm thousands worldwide. The takedown operation disabled more than 200 servers supporting the criminal infrastructure across multiple jurisdictions. ## Methods and collaboration Authorities employed legal warrants to infrastructure providers and coordinated with ISPs to block suspicious traffic. Dr. Benjamin Krause from Frankfurt Prosecutor's Office stated their 'disruptive law enforcement approach works,' while BKA's cybercrime chief highlighted their capability to dismantle even sophisticated phishing operations. ## Identity confusion Kratos was also known as SneakyLog and Sneaky 2FA in underground markets. Beyond Microsoft templates, it offered lures mimicking SharePoint, OneDrive, Canva and Adobe. While Microsoft dates its emergence to early 2025, KnowBe4 reports first sightings in January 2026. Consensus exists about primary targets being in the US and Europe. ## Sectoral consequences US manufacturing, retail and healthcare sectors were primary targets, while European attacks focused on industrial organizations, law firms, technical schools and SMBs. BKA's 'phishing won't go unpunished' message signals continued aggressive stance against cybercrime. This operation underscores international cooperation's critical role in combating digital threats. ## Sources covering this story - https://www.theregister.com/security/2026/07/21/german-authorities-lead-takedown-of-kratos-phishing-platform/5275666 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._