Last seven days
- First activity
- Aug 4, 2026
- Last activity
- Aug 4, 2026
- Feed role
- Distribution
- Host form
- 0 IP / 1 hostnames
Observed infrastructure
Leading locations
- US1
Leading providers
- Cloudflare, Inc.1
Infrastructure traits
- Anycast 1
- Hosting 1
MITRE ATT&CK
Kratos in ATT&CK
15 distinct techniquesTechniques
15 techniques T1111 Multi-Factor Authentication Interception T1555 Credentials from Password Stores T1539 Steal Web Session Cookie T1566 Phishing T1557 Adversary-in-the-Middle T1649 Steal or Forge Authentication Certificates T1078 Valid Accounts T1056 Input Capture T1566.002 Spearphishing Link T1566.003 Spearphishing via Service T1566.001 Spearphishing Attachment T1537 Transfer Data to Cloud Account T1567 Exfiltration Over Web Service T1036 Masquerading T1071.001 Web Protocols
Reporting
Research mentioning Kratos
Jul 22
Cyber Security News
Authorities Shut Down Phishing Empire Launching 15,000 Attacks Every Month
German authorities, working with the United States and Indonesia, dismantled the core infrastructure of Kratos, a phishing-as-a-service platform described as one of the world’s most widely used criminal phishing services. Investigators seized or neutralized more than 200 servers and arrested the alleged developer and technical administrator in Indonesia, a move authorities said rendered the service inoperable. The action was carried out under Operation Olympus Blade, and the FBI took control of Kratos-linked domains to support follow-on investigation and customer identification. Kratos supplied Microsoft-themed phishing pages designed to steal credentials and session cookies, allowing attackers to hijack accounts and bypass multi-factor authentication. Authorities said the platform was used by roughly 1,800 criminal customers to launch about 15,000 phishing campaigns per month against victims in at least 35 countries, with organizations in the United States and Europe—particularly in manufacturing, retail, healthcare, and education—among the main targets. Investigators estimate the operation generated more than €300,000 since 2024.
Jul 22
The Hacker News
Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA
Jul 22
Help Net Security
Police dismantle Kratos phishing platform behind 15,000 monthly campaigns - Help Net Security
Jul 22
Teiss News
teiss - News - German and U.S. authorities dismantle Kratos phishing kit, arrest developer in Indonesia
Jul 22
Trend Micro Research
Law Enforcement Takes Down Kratos/Sneaky2FA Phishing Service, With an Assist From TrendAI™ | Trend Micro (US)
Jul 21
Scworld
German authorities dismantle Kratos phishing-as-a-service infrastructure | brief | SC Media
Jul 21
Bleeping Computer
Police dismantle Kratos phishing platform, arrest developer
Jul 20
Bka
