1. Executive summary
German authorities (ZIT and BKA), supported by the US and Indonesia, have dismantled the primary infrastructure of the Kratos phishing-as-a-service (PhaaS) kit and arrested its alleged developer and technical administrator in Indonesia. The platform enabled over 1,800 criminal enterprises to launch approximately 15,000 phishing campaigns per month, harvesting credentials and session cookies to bypass MFA via Microsoft-themed (and other) phishing pages, targeting hundreds of thousands of victims across 30+ countries since 2024. Attribution of the kit to the aliases "SneakyLog" and "Sneaky 2FA" is drawn from open-source reporting but is unconfirmed — no MITRE ATT&CK profile exists for any of these actor names. EMEA financial services should treat this as a disruption of a significant credential-theft supply chain but assume residual infrastructure and cached phishing domains may remain active for a short period.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 18: classification of ICT-related incidents and cyber threats | Kratos was a platform used to harvest credentials and session cookies from hundreds of thousands of victims across 30+ countries, including European organisations. Financial entities that suffered credential loss through Kratos campaigns must classify those events as ICT-related incidents. | Clients should retrospectively review authentication logs and incident records for Kratos-related credential compromise and ensure any confirmed incidents are classified per their DORA Art. 18 taxonomy. |
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | If a client organisation suffered a Kratos-mediated credential theft that led to account takeover or unauthorised transaction access meeting the entity's major-incident threshold, reporting obligations are engaged. | Clients must assess whether any Kratos-related compromise meets their major-incident criteria and, if so, file or amend reports to competent authorities. |
No specific NIS2 or UK NIS article is directly engaged by this item beyond general incident-management obligations that apply to any security event.
3. Technical analysis & attack chain
How the Kratos PhaaS operation worked (confirmed from source material)
- Platform provisioning: Kratos operated as a subscription PhaaS kit, providing low-skill criminals with pre-built phishing infrastructure. More than 200 servers were neutralised in the takedown, indicating a substantial hosted footprint. The kit's operator allegedly earned over €300,000 ($342,000) since 2024.
- Lure delivery: Kratos customers deployed themed phishing pages impersonating legitimate services. Confirmed lure themes include: Microsoft authentication pages (the primary template cited by German authorities), SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and Adobe. In the US, SneakyLog-branded campaigns also used fake W-2 tax form lures.
- Credential and session-cookie harvesting: The phishing pages captured passwords and session cookies. The session-cookie theft capability is the MFA-bypass mechanism — stolen cookies allow the attacker to replay an authenticated session without requiring a second factor.
- Scale: Approximately 1,800 criminal enterprises used the platform. The kit generated roughly 15,000 phishing campaigns per month, each with the potential to reach several thousand recipients. Target sectors in Europe included industrial organisations, law firms, polytechnic institutions, schools, and SMBs. US targets were concentrated in manufacturing, retail, and healthcare.
- Takedown method: Authorities neutralised the 200+ servers but declined to specify the technical method. Based on prior operations, likely techniques include serving legal warrants to the hosting provider and coordinating with ISPs to null-route or sinkhole traffic to suspect IP addresses. This is not confirmed for this specific operation.
Attribution and naming uncertainty (single-sourced / contested)
- German authorities referred to the kit only as "Kratos." The linkage to "SneakyLog" and "Sneaky 2FA" comes from open-source reporting (Microsoft and others) and is not confirmed by law enforcement. No MITRE ATT&CK profile exists for "Kratos," "SneakyLog," or "Sneaky 2FA" — treat all actor attribution as unconfirmed.
- Microsoft stated SneakyLog entered the phishing-kit market in early 2025. KnowBe4 reported the first signs of Kratos emerged in January 2026 and did not mention SneakyLog or Sneaky 2FA, instead claiming Kratos evolved from a family of commercial trojans and infostealers. These accounts are irreconcilable from the available sources.
- The arrested individual in Indonesia is identified only as the "developer and technical administrator." No further identity details are available in the source material.
4. Mitigation & containment
P1 — Within 24 hours
- Block residual Kratos infrastructure: Although 200+ servers were neutralised, sinkholing and null-routing may not be fully propagated across all ISPs. Coordinate with your threat-intel feed provider to obtain any Kratos-associated domain/IP blocklists and push them to web proxies, email security gateways, and DNS filtering.
- Hunt for session-cookie theft impact: Search authentication logs for anomalous session activity consistent with cookie replay — sessions originating from unexpected IPs or ASNs shortly after a user received a phishing email, particularly involving Microsoft 365, SharePoint, OneDrive, or Adobe credentials. Focus on the period from January 2025 (or January 2026 per KnowBe4) to present.
- Review MFA-bypass detection coverage: Ensure your SIEM/EDR detects token-theft patterns: concurrent sessions from geographically implausible locations, session tokens used outside the normal user-agent fingerprint, and authentication events lacking a corresponding MFA challenge when session cookies are replayed.
P2 — Within 72 hours
- Retrospective incident review: If your organisation experienced confirmed credential-theft incidents in the past 18 months involving Microsoft-themed phishing pages (or SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, Adobe lures), assess whether they align with Kratos kit characteristics. If so, evaluate whether prior incident classifications and any regulatory reports need amendment under DORA Art. 18/19.
- User awareness reinforcement: Targeted phishing simulations using the confirmed lure themes (Microsoft auth, SharePoint, OneDrive, Adobe, Canva, Tilda, Microsoft Forms) for finance, legal, and administrative staff — the sectors highlighted in European targeting.
P3 — Within 7 days
- Session revocation hardening: Implement or verify policies that revoke active sessions upon password reset, and enforce short-lived session tokens for high-value applications. Confirm that conditional access policies restrict session persistence for unmanaged devices.
- Threat-intel feed update: Confirm your subscribed threat-intel providers have incorporated Kratos takedown indicators into their feeds and that any stale Kratos IOCs are retired to avoid false positives.
5. Indicators of compromise
No atomic indicators of compromise (IPs, domains, hashes, URLs) are available in the source material. The takedown announcement did not publish specific IOCs, and authorities declined to detail the technical method of infrastructure neutralisation.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Phishing pages impersonating Microsoft authentication, SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, or Adobe login portals | Email security gateway URL analysis; web proxy logs; user-reported phishing mailbox | High — multiple sources corroborate these lure themes |
| Session-cookie theft enabling MFA bypass (authenticated session replay without second-factor challenge) | Identity provider sign-in logs; SIEM correlation of session token usage vs. MFA challenge events | High — explicitly described by German authorities |
| Credential harvesting via convincing Microsoft-themed fake login pages | Web proxy DNS/URL filtering; EDR browser-intercept telemetry | High — confirmed by ZIT/BKA statement |
| Phishing campaigns targeting European law firms, industrial organisations, polytechnic institutions, schools, and SMBs | Email security gateway campaign analytics; user phishing reports | Medium — sourced to ANY.RUN reporting |
6. Detection
Insufficient indicators to author detection rules. The source material describes lure themes and behavioural patterns (session-cookie theft, MFA bypass) but does not provide specific artefacts such as phishing kit filenames, hardcoded strings, mutex names, registry keys, C2 domains, or command-line patterns that would enable a functional YARA or Sigma rule. Authoring rules from lure theme names alone (e.g., "SharePoint," "OneDrive") would produce excessive false positives against legitimate traffic.
7. Sources
- The Register — "Kratos phishing-as-a-service kit loses its battle with international law enforcement" — https://www.theregister.com/security/2026/07/21/german-authorities-lead-takedown-of-kratos-phishing-platform/5275666 — 2026-07-21
- BleepingComputer — "Police dismantle Kratos phishing platform, arrest developer" — https://www.bleepingcomputer.com/news/security/police-dismantle-kratos-phishing-platform-arrest-developer/ — 2026-07-21
8. Adverse Trace position
This is a high-impact disruption of a prolific credential-theft infrastructure. Kratos's scale — 1,800 criminal customers, 15,000 campaigns per month, 200+ servers — places it among the most significant PhaaS operations targeting European organisations. The arrest of the alleged developer in Indonesia is a meaningful but incomplete outcome; the kit's customer base is large, and residual phishing domains or cached infrastructure may persist. Attribution to "SneakyLog" and "Sneaky 2FA" is unconfirmed and contested across sources — we will not treat these aliases as definitive until corroborated by law enforcement or additional primary evidence. For EMEA financial services, the immediate priority is retrospective hunting for session-cookie theft impact: any organisation that experienced Microsoft-themed phishing incidents in the past 12–18 months should re-examine those events for Kratos kit characteristics and assess whether prior incident classifications require amendment. We will monitor for published IOCs from participating authorities and update clients as indicators become available.
Published via PulseTrace — Adverse Trace threat intelligence.