2026-07-24NOTABLEA German-led takedown removes Kratos's infrastructure, but the AiTM tradecraft and affiliate base survive, as Tycoon2FA already showed
Kratos (phishing-as-a-service)
tool · tool:kratos-phaas
Adversary-in-the-middle Microsoft 365 phishing-as-a-service platform evolved from the Sneaky2FA kit, offering browser-in-the-browser fake login windows (added November 2025) and Cloudflare Turnstile anti-bot challenges; ~1,800 subscribers ran an estimated 15,000 campaigns/month across 200+ servers. Infrastructure seized and its developer arrested in a German BKA-led takedown with US and Indonesian partners, 2026-07-20 (BKA; Trend Micro, 2026-07-20/22).
Aliases: Sneaky2FA
Coverage
1
first 2026-07-24 → last 2026-07-24
Latest activity
2026-07-24
A German-led takedown removes Kratos's infrastructure, but the AiTM tradecraft and affiliate base survive, as…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, finance, technology · regions: europe, us
Sources cited
2
2 hosts
Defender insights
What each entry about Kratos (phishing-as-a-service) tells a defender to do, newest first.
Triage
Story timeline
ATT&CK techniques (3 across 3 tactics)
3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
- Initial AccessPhishing: Spearphishing Link
- Credential AccessSteal Web Session Cookie · Adversary-in-the-Middle
- CollectionAdversary-in-the-Middle
Initial Access TA0001
T1566.002Phishing: Spearphishing Link×1
Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Evidence: 2026-07-24/kratos-phaas-takedown-bka-sneaky2fa-m365-aitm · ATT&CK page ↗
Credential Access TA0006
T1539Steal Web Session Cookie×1
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
Evidence: 2026-07-24/kratos-phaas-takedown-bka-sneaky2fa-m365-aitm · ATT&CK page ↗
T1557Adversary-in-the-Middle×1
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Evidence: 2026-07-24/kratos-phaas-takedown-bka-sneaky2fa-m365-aitm · ATT&CK page ↗
Collection TA0009
T1557Adversary-in-the-Middle×1
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing, Transmitted Data Manipulation, or replay attacks (Exploitation for Credential Access). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.
Evidence: 2026-07-24/kratos-phaas-takedown-bka-sneaky2fa-m365-aitm · ATT&CK page ↗
Entries about Kratos (phishing-as-a-service) (1)
Co-occurring entities
Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.
Where this entity is cited
Source distribution
- bka.de1 (50%)
- trendmicro.com1 (50%)