Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA - The Hacker News

What the report says

The Hacker News reported that German and U.S. law enforcement disrupted the core infrastructure behind Kratos, a phishing kit aimed at Microsoft 365 users, while Indonesian authorities arrested the man accused of developing and operating it. According to the report, Germany’s ZIT cybercrime unit and the Federal Criminal Police Office said more than 200 servers were taken offline in an operation announced Monday.

Investigators described Kratos as a widely used criminal phishing service, estimating that about 1,800 paying users ran roughly 15,000 campaigns each month. The kit allegedly supported theft of both passwords and session cookies, allowing attackers in some cases to bypass multi-factor authentication by taking over an authenticated Microsoft 365 session. The article cited analysis from ANY.RUN saying Kratos could operate either as a basic credential-harvesting page or as a Node.js reverse proxy using an adversary-in-the-middle approach.

The service was reportedly sold through a website and Telegram shop, with customers paying in cryptocurrency and managing campaigns through the platform. Authorities estimated victims since late 2024 numbered in the hundreds of thousands across more than 30 countries, mainly in Europe and the United States, and said operators made more than 300,000 euros since 2024. Microsoft, which tracks the same platform as SneakyLog, is notifying affected users, according to the report.

The takedown matters because stolen Microsoft 365 access can enable follow-on fraud, internal compromise and business email compromise. The Hacker News noted that although the seized servers are offline, investigators did not necessarily remove copies of the kit or identify all customers, leaving open the risk that similar infrastructure could reappear.