Breach · Identity Security

Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA

July 22, 2026 · 5 min read

On July 20, 2026, a joint operation between Germany's BKA and ZIT, the FBI's Dallas Field Office, and the US Attorney's Office for the Northern District of Texas dismantled the Kratos Phishing-as-a-Service platform, seized more than 200 servers, and saw Indonesian authorities arrest the alleged developer. The operation, named Operation Olympus Blade, targeted a criminal service that law enforcement described as one of the most widespread and dangerous phishing kits in the world, one that had run approximately 15,000 phishing campaigns per month against Microsoft 365 users across more than 30 countries. What makes Kratos worth paying attention to is the attack technique at its core: the kit was engineered to steal session cookies alongside credentials, giving attackers a way past MFA entirely, no matter how strong the second factor was.

What actually happened

Kratos operated as a subscription-based Phishing-as-a-Service platform, sometimes called a PhaaS or a "digital construction kit" in the BKA's characterization. More than 1,800 criminal customers subscribed to it, and the platform generated more than €300,000 (roughly $342,000 USD) in revenue since 2024. Those customers used it to stand up convincing fake Microsoft 365 sign-in portals, collect usernames, passwords, and email addresses, and then move on to account takeover. ANY.RUN research found the Kratos operator panel appeared active as early as September 2025, with the kit visible in the wild from at least January 2026. Forescout observed the campaign rotating its lures with the calendar, using tax themes in winter and event invitations tied to Valentine's Day and Easter later in the year.

The technical mechanism is the piece that matters most. Kratos used an Adversary-in-the-Middle technique, positioning its infrastructure between the victim and the legitimate Microsoft authentication endpoint. When a victim typed their credentials into the fake portal, the kit relayed the login to Microsoft in real time, captured the resulting session cookie, and handed that cookie back to the attacker. At that point the attacker holds an authenticated session token. The MFA prompt has already been satisfied. The attacker can replay that token from their own browser and walk straight into the account. The BKA confirmed approximately 850 victims across 35 countries, concentrated in Europe and the United States, though broader law-enforcement estimates put the potential victim count in the hundreds of thousands.

Microsoft Threat Intelligence tracks what it believes is the same kit under the name SneakyLog, and dates its entry into the phishing kit market to early 2025. KnowBe4 assessed Kratos as having evolved from an earlier family of commercial trojans and infostealers, and reported first sightings in January 2026. The two accounts do not fully reconcile, and no authoritative determination has been published. What is consistent across all sources is the AiTM session-theft capability and the scale of deployment. The seized servers are now being analyzed forensically, and the BKA has stated they expect that evidence to help identify Kratos customers who remain at large. Germany's Federal Office for Information Security (BSI) published phishing prevention guidance for potentially affected users following the announcement.

Why this should matter to you even if you don’t run Microsoft 365

If your organization runs Microsoft 365, which covers the majority of enterprise and mid-market environments at this point, the Kratos takedown is a direct reminder that MFA configured with SMS codes or time-based one-time passwords does not protect an account once a session cookie has been captured. The AiTM technique Kratos used is well documented and has been in active use by multiple threat groups for several years. The difference here is the industrialization: a subscription service with 1,800 customers running 15,000 campaigns a month means the attack surface is effectively anyone who clicks a phishing link, across any industry, in any geography. Victims spanned 35 confirmed countries, concentrated in Europe and the United States, with ANY.RUN identifying 148 suspected victim organizations in the US, Spain, and Southern Europe alone.

The broader pattern worth internalizing is that the phishing kit ecosystem has matured to the point where the technical barrier to running an AiTM campaign is close to zero for anyone willing to pay a subscription fee. Kratos was described by the BKA as one of the most dangerous platforms of its kind, and it was generating that scale with a relatively modest revenue figure, which tells you the market is competitive and other services almost certainly fill a similar role. Takedowns disrupt specific infrastructure, but the underlying capability gets rebuilt or migrated. Organizations that treat MFA as a checkbox, particularly MFA implementations that rely on token-based factors that can be replayed after AiTM interception, are carrying residual risk that the Kratos ecosystem was purpose-built to exploit.

The control that would have blunted it

The control that directly addresses AiTM session theft is phishing-resistant MFA, specifically FIDO2 hardware security keys or device-bound passkeys using the WebAuthn standard. These factors are cryptographically bound to the origin domain at the time of authentication. When a victim is interacting with a fake portal, the origin does not match, and the authentication simply fails. The attacker gets nothing. This is categorically different from TOTP codes or push notifications, which can be relayed through an AiTM proxy in real time. Cyber insurers are increasingly distinguishing between "MFA present" and "phishing-resistant MFA present" in their underwriting questionnaires, and the Kratos-style attack is exactly why that distinction exists.

Deploying FIDO2 across an enterprise is not trivial. You need hardware token procurement and distribution, enrollment workflows, fallback procedures for lost keys, and helpdesk training to handle the inevitable lockout tickets. For organizations that cannot move to hardware tokens quickly, Conditional Access policies in Microsoft Entra ID (formerly Azure AD) that enforce token binding, limit session lifetime, and flag anomalous token replay patterns represent a meaningful interim layer. Microsoft's Entra ID also supports Continuous Access Evaluation, which can revoke sessions in near real time when risk signals appear, reducing the window an attacker has to use a stolen cookie. Neither of these is a complete substitute for phishing-resistant MFA, but they raise the cost and complexity for an attacker working from a replayed session token.

The other operational reality worth naming is monitoring. Even with phishing-resistant MFA in place, your environment should be generating alerts on impossible-travel events, new device registrations, and bulk email rule changes in Exchange Online, all of which are common post-compromise actions once an attacker has account access. If you are relying solely on MFA to stop account takeover and have no detection layer watching for what happens after a successful login, a stolen cookie from a legacy application or an unenrolled device can still result in a breach. Defense in depth here means both hardening the authentication path and watching the behavior that follows it.

Strondex's MFA Readiness assessment maps your current authentication controls against phishing-resistant standards and the requirements cyber insurers are applying to Microsoft 365 environments.