International Cybercrime Ring Dismantled as German and US Authorities Target ‘Kratos’ Phishing-as-a-Service Infrastructure, Indonesian Arrest Made

In a significant triumph against global cybercrime, a coordinated operation led by German and US law enforcement, with crucial assistance from Indonesian authorities, has successfully dismantled the core infrastructure of "Kratos," identified by German investigators as one of the world’s most pervasive criminal phishing kits. The operation culminated on Monday, July 22, 2026, with the arrest in Indonesia of the individual alleged to be the developer and primary operator behind the sophisticated Phishing-as-a-Service (PhaaS) platform. This decisive action represents a critical blow to an illicit enterprise that has victimized hundreds of thousands across more than 30 countries, demonstrating the escalating commitment of international agencies to disrupt the digital underworld.

The Genesis of a Global Takedown

The joint announcement, issued by the Frankfurt public prosecutor’s cybercrime unit (ZIT) and Germany’s Federal Criminal Police Office (BKA), detailed the extensive reach of the operation. Over 200 servers globally, integral to Kratos’s functionality, were taken offline, effectively paralyzing a vast network of cybercriminal activity. This coordinated strike was the culmination of months of intensive intelligence gathering, technical analysis, and cross-border collaboration, underscoring the necessity of international partnerships in confronting the transnational nature of modern cyber threats. The German BKA, in particular, has lauded this initiative as a testament to their "disruptive" strategy, which aims to dismantle criminal services outright rather than merely apprehending individual actors.

Kratos distinguished itself not just by its sheer scale but by its advanced technical capabilities. Unlike rudimentary phishing kits that merely harvest usernames and passwords, Kratos was engineered to steal session cookies alongside login credentials. This crucial distinction allowed its "customers" – whom the BKA aptly termed "franchisees" – to bypass even robust two-factor authentication (2FA) mechanisms, gaining direct access to user accounts as if they were the legitimate account holders. This sophisticated method, known as an Adversary-in-the-Middle (AiTM) attack, has rendered conventional 2FA a significantly weaker defense than often perceived, highlighting an evolving challenge for cybersecurity protocols worldwide.

Unmasking Kratos: A Technical Deep Dive

Cybersecurity research firm ANY.RUN played a pivotal role in dissecting the inner workings of Kratos, providing invaluable intelligence that aided law enforcement. Their reverse-engineering efforts revealed the kit’s dual operational modes, showcasing its versatility and appeal to a wide spectrum of threat actors. The simpler mode involved a plain PHP page designed primarily for credential harvesting. However, the more dangerous and innovative aspect was its Node.js reverse proxy, meticulously crafted to relay login attempts to legitimate services, such as Microsoft, in real-time. This live relay mechanism allowed Kratos to intercept and capture the resulting session cookie directly, granting the attacker an authenticated session token that persists even after a password change. This effectively circumvents 2FA by inheriting the authentication already performed by the legitimate user during the proxying process.

The operational model of Kratos mirrored that of a legitimate software-as-a-service (SaaS) provider, demonstrating the professionalization of cybercrime. Customers accessed Kratos through a dedicated website and a Telegram-based shop, where they could manage their accounts, select targets, and organize phishing campaigns with relative ease. This "franchise" approach significantly lowered the technical barrier to entry for aspiring cybercriminals, enabling even low-skill actors to deploy highly effective AiTM phishing attacks against a broad range of targets. Payments for these illicit services were typically rendered in cryptocurrency, providing a layer of anonymity that has historically complicated law enforcement efforts.

A Trail of Deception: Chronology of Kratos’s Operations

The activities of Kratos, also identified by Microsoft Threat Intelligence as "SneakyLog," have been under scrutiny for some time. Microsoft’s security researchers began tracking this PhaaS platform as early as 2025, noting its consistent use in credential and 2FA theft campaigns primarily targeting Microsoft 365 environments.

• Late 2024: Kratos begins its operations, accumulating a rapidly growing victim count across Europe and the United States. Initial intelligence suggests hundreds of thousands of individuals and organizations fell prey to its campaigns.
• Early 2025: Microsoft Threat Intelligence officially identifies and begins tracking the kit under the moniker "SneakyLog," recognizing its distinct operational patterns and sophisticated AiTM capabilities.
• February 10, 2026: A particularly insidious campaign attributed to Kratos (SneakyLog) is launched. Threat actors dispatch tax-themed emails to approximately 100 organizations, predominantly in the United States. These emails contained malicious W-2 documents embedded with personalized QR codes. Scanning these codes redirected recipients to meticulously crafted fake Microsoft 365 login pages, designed to capture credentials and session cookies. Sectors targeted included manufacturing, retail, and healthcare, illustrating the broad scope of Kratos’s criminal enterprise.
• March 19, 2026: Microsoft publishes a detailed blog post, "When Tax Season Becomes Cyberattack Season: Phishing and Malware Campaigns Using Tax-Related Lures," publicly detailing the mechanics and dangers of SneakyLog, providing crucial threat intelligence to the cybersecurity community. This publication further solidified the understanding of Kratos’s operational methodologies.
• July 22, 2026: The coordinated international law enforcement action culminates in the takedown of Kratos’s infrastructure and the arrest of its alleged developer in Indonesia, marking a significant milestone in the fight against PhaaS platforms.

The Human and Financial Cost of Cybercrime

Investigators estimate that Kratos’s 1,800 paying customers were collectively running approximately 15,000 phishing campaigns each month. These campaigns ensnared hundreds of thousands of victims since late 2024, spread across more than 30 countries, with a pronounced concentration in Europe and the United States. The financial illicit gains for the operators of Kratos are estimated to exceed 300,000 euros since 2024, a figure that only reflects direct payments for the service and does not account for the vastly larger economic damages inflicted upon the victims through subsequent fraud, data breaches, and business disruption. Each campaign, meticulously designed for maximum impact, had the potential to reach several thousand recipients, underscoring the platform’s efficiency in widespread compromise.

The stolen Microsoft logins, facilitated by Kratos, were rarely the final objective. As is common in the cybercriminal ecosystem, these compromised credentials served as valuable commodities or initial footholds for further illicit activities. They could be leveraged for subsequent, more targeted phishing attacks, sold on dark web marketplaces to other criminal groups, or, more alarmingly, used to gain deeper access within corporate networks. The path from a single phished inbox to a full-scale business email compromise (BEC) or ransomware attack is well-trodden, making the neutralization of platforms like Kratos crucial in preventing cascading cyber incidents.

Law Enforcement’s Strategic Victory and Future Challenges

Carsten Meywirth, who heads the BKA’s cybercrime division, emphasized the significance of this operation, stating, "This operation shows that even highly professional phishing infrastructures can be effectively combated through decisive and coordinated action." Benjamin Krause of the ZIT further highlighted the office’s "disruptive" approach, stressing the importance of dismantling criminal services at their root rather than solely pursuing individual perpetrators. This strategy aims to create lasting impediments to cybercriminal operations by destroying their enabling infrastructure, thereby increasing the cost and complexity for malicious actors.

In the aftermath of the takedown, Microsoft is actively engaged in notifying users who were caught in Kratos’s campaigns. The prescribed remediation steps vary depending on the nature of the compromise. For instances where only credentials were harvested, a password reset combined with a thorough MFA check is sufficient. However, for victims whose live session cookies were lifted via the kit’s reverse-proxy mode, the situation is more critical. In such cases, a password reset alone is insufficient, as the stolen session token can persist beyond the password change. Affected users are strongly advised to revoke all active sessions and, for high-value accounts, transition to phishing-resistant sign-in methods, such as FIDO2 security keys, which offer superior protection against AiTM attacks.

Indicators of Compromise and Sustained Vigilance

For cybersecurity defenders and incident responders, ANY.RUN’s analysis provided crucial Indicators of Compromise (IoCs) that can aid in identifying past or ongoing Kratos/SneakyLog activity. The kit’s login pages almost invariably loaded two specific paired assets: barr.svg and lg.svg. Stolen credentials were then typically POSTed to endpoints such as next.php or save.php. ANY.RUN rates this pairing with a high recall rate of 90% and near-zero false positives, making it a reliable signature for detection.

While the immediate impact of the takedown is significant – with the servers offline and Kratos-powered campaigns effectively halted – the enduring nature of cybercrime presents ongoing challenges. The operation did not address the approximately 1,800 customers who previously utilized Kratos, nor did it seize every copy of the kit’s underlying code. Threat actors are known for their adaptability; Kratos was often observed running on disposable domains, compromised WordPress sites, and shared hosting environments alongside other AiTM kits. This modular and distributed nature means that while Kratos itself may be crippled, the core capabilities and the "franchise" model could re-emerge under a new name, leveraging existing codebases or rapidly developing new ones.

The successful dismantling of the Kratos Phishing-as-a-Service infrastructure stands as a powerful testament to the efficacy of international law enforcement collaboration in the digital age. It sends a clear message to cybercriminals that their sophisticated tools and distributed networks are not beyond the reach of justice. However, this victory also serves as a stark reminder of the continuous need for robust cybersecurity defenses, user education on evolving threats like AiTM phishing, and the imperative for organizations and individuals to adopt advanced, phishing-resistant authentication methods to safeguard their digital identities in an ever-evolving threat landscape. The fight against cybercrime is a continuous battle, and while Kratos has fallen, the hydra of online threats will undoubtedly spawn new heads, demanding perpetual vigilance and innovation from the global cybersecurity community.