1. Executive summary
German (ZIT/BKA) and U.S. law enforcement dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform, seizing 200+ servers and arresting the alleged developer in Indonesia under Operation Olympus Blade. Kratos was rented to 1,800+ criminal customers who launched ~15,000 phishing campaigns per month across 35+ countries, primarily targeting Europe and the U.S. The kit specialised in Microsoft-themed credential harvesting and MFA bypass via session-cookie theft. No verified reference data was resolved for this item; CVSS, CISA-KEV, and MITRE actor profiles are not applicable. Attribution of the kit to prior names (SneakyLog, Sneaky 2FA) is single-sourced via open-source reporting and unconfirmed.
2. Regulatory framing
No specific DORA/NIS2 article is directly engaged by this item. The takedown of a criminal PhaaS platform is a law-enforcement action, not an ICT-related incident at a regulated entity. Clients whose users were compromised via Kratos phishing pages would trigger incident-management obligations under their own compromise, not under this takedown event itself.
3. Technical analysis & attack chain
How the Kratos PhaaS operation worked (confirmed from source facts)
- Platform provisioning: The Kratos operator(s) maintained a subscription-based PhaaS platform on infrastructure spanning 200+ servers. Criminal customers purchased access, generating at least €300,000 in revenue since 2024.
- Lure delivery: Customers used Kratos to create and manage phishing campaigns using pre-built templates themed around Microsoft authentication pages, SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and Adobe. Targets were primarily in the U.S. and Europe, with manufacturing, retail, healthcare, industrial organisations, and law firms identified as key sectors.
- Credential capture: Victims were directed to convincing fake Microsoft login forms designed to harvest email addresses and passwords.
- MFA bypass: Kratos captured session cookies, enabling attackers to bypass multi-factor authentication and hijack Microsoft accounts without needing the second factor.
- Post-compromise activity: Stolen account access was leveraged for business email compromise (BEC), data theft, account takeover, and further phishing attacks targeting the victims' contacts.
- Scale: ~15,000 campaigns per month, each with the potential to reach several thousand recipients. More than 1,800 criminal enterprises used the service.
- Takedown: Authorities seized 200+ servers, arrested the alleged developer/technical administrator in Indonesia, and transferred domain ownership to the FBI. A seizure banner was placed on the service's website under Operation Olympus Blade.
Attribution and naming uncertainty (single-sourced; verify before enforcement)
German authorities referred to the kit only as "Kratos." Open-source reporting ties it to prior products sold as "SneakyLog" and "Sneaky 2FA" — this linkage is attributed to Microsoft and security vendors (Heal Security, KnowBe4) but is not confirmed by law enforcement. KnowBe4 separately claimed Kratos evolved from a family of commercial trojans and infostealers, and did not mention SneakyLog/Sneaky 2FA. KnowBe4 also reported first signs of Kratos in January 2026, while Microsoft placed SneakyLog's market entry in early 2025. These discrepancies are unconfirmed and rest on single-vendor reporting.
4. Mitigation & containment
P1 — Within 24 hours
- Block residual Kratos infrastructure: Although 200+ servers were seized, not all customer-operated phishing infrastructure may be offline. Review proxy, email gateway, and DNS logs for any remaining Kratos-associated domains or IPs. The FBI now controls the primary domains — traffic to these will display a seizure banner and is not malicious in the current state, but should still be blocked at the egress level as a policy matter.
- Hunt for prior compromises: Search Microsoft 365 / Entra ID sign-in logs for session-token-based authentication anomalies (impossible travel, unfamiliar IP/device, token replay) dating back to early 2025, consistent with Kratos credential-and-cookie theft. Focus on users in manufacturing, retail, healthcare, legal, and industrial sectors.
- Review session token revocation: For any accounts with suspicious sign-in patterns, force full revocation of all active sessions and refresh tokens, not just password reset.
P2 — Within 72 hours
- Retrospective phishing review: Search mail-flow logs and URL-filtering logs for historical phishing URLs matching Kratos template patterns (Microsoft login, SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, Adobe lures). Correlate with any users who clicked through or submitted credentials.
- Callback verification for financial transactions: Given the BEC risk from compromised Microsoft accounts, reinforce existing callback procedures for any payment instruction or banking detail change originating from email. This is a process control, not a technical one.
- MFA hardening: Standard MFA via push or SMS does not prevent session-cookie theft. Evaluate phishing-resistant authentication (FIDO2 hardware keys) for high-risk roles. This is a pre-existing recommendation, not specific to Kratos, but Kratos's MFA-bypass capability makes it actionable now.
P3 — Within 7 days
- Threat-hunt for post-compromise activity: For any confirmed compromised accounts, hunt for mail-forwarding rules, inbox rules hiding phishing replies, OAuth app grants, and lateral movement into SharePoint/OneDrive consistent with the post-compromise behaviours described by BKA.
- User awareness: Brief users — particularly in the targeted sectors — on the takedown and the likelihood that former Kratos customers will migrate to alternative PhaaS platforms. Expect a short-term displacement effect.
5. Indicators of compromise
No atomic indicators of compromise (IPs, domains, hashes, URLs) are available in the source material. Authorities seized 200+ servers and transferred domain ownership to the FBI, but specific server IPs, domains, or file hashes were not published in the provided sources.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Session-cookie-based authentication to Microsoft 365 from unfamiliar IP/device after a user clicked a phishing link | Entra ID sign-in logs; Conditional Access logs | High — consistent with Kratos MFA-bypass mechanism |
| New inbox mail-forwarding rules or auto-delete rules created after suspicious sign-in | Microsoft 365 audit logs (Exchange mailbox audit) | Medium — post-compromise BEC indicator, not Kratos-specific |
| OAuth application grants or consent phishing following credential theft | Entra ID admin centre → Enterprise applications → Consent grants | Medium — common post-compromise technique |
| Phishing pages themed as Microsoft login, SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, Adobe | Email security gateway URL retrospection; web proxy logs | High — matches Kratos template set |
6. Detection
Insufficient indicators to author detection rules. The source material describes the phishing kit's behaviour and template themes but does not provide specific file names, file paths, registry keys, mutex names, command-line strings, hard-coded values, or network signatures that would constitute threat artefacts for YARA or Sigma rule construction. The behavioural indicators in §5 should be implemented as custom detection logic within Entra ID and Microsoft 365 monitoring rather than as portable YARA/Sigma rules.
7. Sources
- BleepingComputer — Police dismantle Kratos phishing platform, arrest developer — https://www.bleepingcomputer.com/news/security/police-dismantle-kratos-phishing-platform-arrest-developer/ — 2026-07-21
- The Register — Kratos phishing-as-a-service kit loses its battle with international law enforcement — https://www.theregister.com/security/2026/07/21/german-authorities-lead-takedown-of-kratos-phishing-platform/5275666 — 2026-07-21
8. Adverse Trace position
This is a high-impact law-enforcement takedown of a top-tier PhaaS platform, not a vulnerability or direct technical compromise of client infrastructure. The immediate threat from Kratos is degraded but not eliminated — 1,800+ criminal customers retain the knowledge and motivation to migrate to alternative platforms, and previously stolen credentials and session cookies remain valid until revoked. EMEA financial services clients should treat this as a trigger for retrospective compromise hunting (not forward-looking patching): search Microsoft 365 sign-in logs for session-token replay anomalies dating to early 2025, revoke tokens for any suspicious accounts, and reinforce BEC callback controls. The attribution of Kratos to SneakyLog/Sneaky 2FA is single-sourced and unconfirmed — do not treat it as authoritative for threat-hunting scope. Adverse Trace will monitor for publication of seized-infrastructure IOCs and for displacement to successor PhaaS platforms.
Published via PulseTrace — Adverse Trace threat intelligence.