Kratos phishing-as-a-service kit loses its battle with international law enforcement

Kratos, a widely used phishing-as-a-service kit that provided convincing Microsoft-themed credential- and session-cookie-harvesting pages enabling MFA bypass, was disrupted by German authorities with US and Indonesian support; more than 200 servers were neutralized and an alleged developer arrested. Authorities estimate Kratos powered roughly 15,000 phishing campaigns per month, was used by ~1,800 criminal enterprises, targeted victims across 30+ countries and multiple industries, and had generated over €300,000 since 2024.