Last seven days
- First activity
- Jul 26, 2026
- Last activity
- Jul 26, 2026
- Feed role
- Distribution
- Host form
- 0 IP / 10 hostnames
Observed infrastructure
Leading locations
- US6
- CY1
Leading providers
- RouterHosting LLC4
- DigitalOcean, LLC2
- Hostinger International Limited1
Infrastructure traits
- Hosting 7
- Anycast 1
MITRE ATT&CK
Kratos in ATT&CK
15 distinct techniquesTechniques
15 techniques T1111 Multi-Factor Authentication Interception T1555 Credentials from Password Stores T1539 Steal Web Session Cookie T1566 Phishing T1557 Adversary-in-the-Middle T1649 Steal or Forge Authentication Certificates T1078 Valid Accounts T1056 Input Capture T1566.002 Spearphishing Link T1566.003 Spearphishing via Service T1566.001 Spearphishing Attachment T1537 Transfer Data to Cloud Account T1567 Exfiltration Over Web Service T1036 Masquerading T1071.001 Web Protocols
Reporting
Research mentioning Kratos
Jul 22
The Hacker News
Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA
German and US law enforcement have taken down the core infrastructure of Kratos, described by German investigators as one of the world's most widely used criminal phishing kits... Microsoft Threat Intelligence identifies the same kit as SneakyLog, a phishing-as-a-service platform it says has run credential-and-2FA theft against Microsoft 365 since at least early 2025.
Jul 21
Scworld
German authorities dismantle Kratos phishing-as-a-service infrastructure | brief | SC Media
German authorities, with support from the US and Indonesia, have successfully dismantled the primary infrastructure behind the Kratos phishing-as-a-service (PhaaS) kit, a tool described as one of the most dangerous and widespread on the market.
Jul 14
Malware News
Kratos PhaaS Targets US and EU Companies: How to Reduce Microsoft 365 Account Takeover Risk - Malware News - Malware Analysis, News and Indicators
Kratos is a mature Phishing-as-a-Service operation targeting Microsoft 365 users across the US, Europe, and other regions.
