The Kratos phishing kit has lost its core server network, but the same customer base and code can reappear under new infrastructure.

The Hacker News reported that German and US law enforcement took down the Microsoft 365 session-theft service after investigators linked it to roughly 1,800 paying customers and about 15,000 phishing campaigns a month.

The operation gives security teams a concrete example of why ordinary multi-factor authentication is no longer enough when an attacker captures a live session token rather than only a password.

More Than 200 Servers Went Offline

The Frankfurt public prosecutor's cybercrime unit ZIT announced with Germany's Federal Criminal Police Office on Monday that more than 200 servers had been pulled offline.

Indonesian authorities arrested the man German investigators identify as the developer and operator of Kratos.

Investigators estimate that the service reached victims in the hundreds of thousands since late 2024, across more than 30 countries, with concentration in Europe and the United States.

The authorities also estimate that the operators earned more than 300,000 euros since 2024.

Kratos was sold as a phishing-as-a-service operation rather than a single campaign.

Customers paid in cryptocurrency, used a dedicated website and Telegram shop, and managed campaigns through the service.

The BKA characterised those customers as franchisees, a label that describes how a working phishing stack was packaged for lower-skill operators.

Session Cookies Made MFA Easier To Bypass

The kit's most important capability was not password theft alone.

The BKA said Kratos was designed to collect the session cookie together with the login, which can let an attacker enter an account as the user even after two-factor authentication has completed.

ANY.RUN found two operating modes after reverse-engineering the kit: a plain PHP page for credential harvesting and a Node.js reverse proxy that relayed the login to Microsoft in real time so the resulting session could be captured.

The adversary-in-the-middle structure leaves the operator with a live access channel, not merely a stolen-password database.

Microsoft 365 Accounts Need Session Checks

The BKA warned that stolen credentials could be resold, reused for further phishing or expanded through Microsoft 365 environments into business email compromise.

That path gives incident responders a different remediation sequence from an ordinary password reset.

Microsoft is notifying users caught in the campaigns.

Where Kratos only harvested credentials, password resets and MFA checks address the immediate exposure; where the reverse-proxy mode lifted an active session, the session itself has to be revoked and high-value accounts need phishing-resistant sign-in.

Defenders also have a hunting clue from the kit.

ANY.RUN found that Kratos login pages almost always loaded the paired assets barr.svg and lg.svg, then posted stolen credentials to endpoints such as next.php or save.php.

According to ANY.RUN, that pairing has 90% recall with near-zero false positives.

The server seizure stops the current Kratos infrastructure, while the public record does not identify the roughly 1,800 customers or whether replacement infrastructure is already active.