Full Report
German and US law enforcement have taken down the core infrastructure of Kratos, described by German investigators as one of the world's most widely used criminal phishing kits, and Indonesian authorities arrested the man they say developed and ran it. In a joint announcement on Monday, the Frankfurt public prosecutor's cybercrime unit (ZIT) and Germany's Federal Criminal Police Office (BKA)
Analysis Summary
# Incident Report: Takedown of Kratos Phishing-as-a-Service (PhaaS)
## Executive Summary
International law enforcement agencies dismantled the infrastructure of "Kratos," a prolific Phishing-as-a-Service platform used by over 1,800 criminals to bypass Multi-Factor Authentication (MFA). The operation resulted in the arrest of the primary developer in Indonesia and the seizure of over 200 servers, disrupting a global operation that targeted hundreds of thousands of victims.
## Incident Details
- **Discovery Date:** Early 2025 (Tracked by Microsoft as "SneakyLog")
- **Incident Date:** Takedown announced July 22, 2026
- **Affected Organization:** Microsoft 365 users across 100+ organizations (specifically manufacturing, retail, and healthcare)
- **Sector:** Technology / Financial / Multi-sector
- **Geography:** Global (arrest in Indonesia; infrastructure in Germany/USA; victims in 30+ countries)
## Timeline of Events
### Initial Access
- **Date/Time:** Late 2024 (Operational start)
- **Vector:** Phishing-as-a-Service (PhaaS) via "Franchisees"
- **Details:** Low-skill attackers purchased access via Telegram/Web portals to launch Adversary-in-the-Middle (AiTM) attacks.
### Lateral Movement
- **Details:** Stolen session cookies and credentials allowed attackers to move from a single phished inbox to full Business Email Compromise (BEC) and lateral internal phishing.
### Data Exfiltration/Impact
- **Details:** Compromise of Microsoft 365 accounts, theft of session cookies (bypassing MFA), and unauthorized access to corporate environments and W-2 tax documents.
### Detection & Response
- **Detection:** Identified by Microsoft Threat Intelligence (as SneakyLog) and ANY.RUN through reverse engineering.
- **Response:** In July 2026, the BKA (Germany), ZIT (Germany), US law enforcement, and Indonesian authorities seized 200 servers and arrested the lead developer.
## Attack Methodology
- **Initial Access:** Phishing emails, often tax-themed with QR codes leading to fake login pages.
- **Persistence:** Use of stolen session cookies which bypasses the need for re-authentication.
- **Defense Evasion:** Use of disposable domains, compromised WordPress sites, and Node.js reverse proxies to hide the phishing origin.
- **Credential Access:** Adversary-in-the-Middle (AiTM).
- **Lateral Movement:** Using phished credentials to send internal emails within a trusted environment.
- **Collection:** Automated harvesting of passwords and real-time capture of MFA session tokens.
- **Impact:** Account takeover (ATO) and financial fraud (BEC).
## Impact Assessment
- **Financial:** Operators earned estimated €300,000+; potential victim losses are significantly higher.
- **Data Breach:** Hundreds of thousands of users across 30+ countries.
- **Operational:** Disruption of business communications; 15,000 phishing campaigns per month.
- **Reputational:** High-level compromise of organizational identity systems.
## Indicators of Compromise
- **File indicators:** `barr.svg`, `lg.svg` (Assets loaded by phishing pages)
- **Behavioral indicators:**
- POST requests to endpoints: `/next.php` or `/save.php`
- High-frequency tax-themed emails containing QR codes
- Logins from unusual locations immediately following a specific web interaction
## Response Actions
- **Containment:** 200+ servers seized and taken offline by BKA/ZIT.
- **Eradication:** Arrest of the developer/operator in Indonesia.
- **Recovery:** Microsoft is notifying affected users to reset credentials and revoke active sessions.
## Lessons Learned
- **MFA is not a Silver Bullet:** Traditional MFA (SMS/App codes) is vulnerable to session-hijacking via proxy-based phishing kits.
- **Infrastructure Takedown Matters:** Dismantling the central PhaaS hub is more effective than chasing individual "franchisee" attackers.
- **QR Codes as a Blind Spot:** Attackers are successfully using QR codes to bypass traditional email scanners that focus on URL analysis.
## Recommendations
- **Phishing-Resistant MFA:** Implement FIDO2/WebAuthn security keys to prevent AiTM session theft.
- **Session Revocation:** In the event of a suspected breach, organizations must revoke all active sessions, as password resets alone do not invalidate stolen cookies.
- **Educational Awareness:** Train employees to never scan QR codes from unexpected emails, even if they appear to lead to familiar portals like Microsoft 365.