NOTABLENATOA1threat

German BKA dismantles Kratos, the Sneaky2FA-derived AiTM phishing-as-a-service platform behind ~15,000 monthly Microsoft 365 credential-theft campaigns

A German-led takedown removes Kratos's infrastructure, but the AiTM tradecraft and affiliate base survive, as Tycoon2FA already showed

first published 2026-07-24 04:36 UTC

Analysis

Germany's Bundeskriminalamt (BKA), with the Frankfurt cybercrime prosecutor (ZIT), US law enforcement and Indonesian authorities, announced on 20 July 2026 the takedown of Kratos, a phishing-as-a-service (PhaaS) platform that sold subscribers a turnkey adversary-in-the-middle toolkit for generating convincing Microsoft 365 authentication pages (BKA, 2026-07-20). Per BKA and Trend Micro (which had tracked Sneaky2FA's evolution into Kratos since December 2024) the platform added browser-in-the-browser (BitB) fake login windows in November 2025 and Cloudflare Turnstile anti-bot challenges to blunt automated analysis and takedown, and ran an estimated 15,000 phishing campaigns a month across 200+ servers for roughly 1,800 subscribers (Trend Micro, 2026-07-22). Authorities seized the infrastructure and arrested the platform's developer/technical administrator in Indonesia (BKA, 2026-07-20).

Defender takeaway

A takedown removes infrastructure, not the affiliate base or the kit's code, so Swiss and European M365 tenants should expect Kratos affiliates to rebrand and re-tool rather than stand down, the pattern other AiTM phishing-as-a-service operations have followed after their own disruptions. The durable defence is against the AiTM technique class, not this brand: enforce phishing-resistant authentication (FIDO2/passkeys or certificate-based) for privileged and high-value M365 accounts, since AiTM proxies relay password and OTP but cannot replay a hardware-bound assertion, and treat a valid sign-in from an anomalous location immediately after a session-token event as a token-replay indicator. Triage: BitB and off-domain hosting give two concrete discriminators a real Microsoft login lacks, a "browser window" rendered as an in-page DOM overlay rather than a genuine top-level navigation to login.microsoftonline.com, and a Microsoft-branded login flow gated behind a Cloudflare Turnstile challenge and served from a non-Microsoft domain; either should fail a user or a URL-inspection control before credentials are entered.

Cited evidence

Over 1,800 criminal subscribers had rented access to Kratos and used it to run an estimated 15,000 phishing campaigns a month.

Trend Micro Research 2026-07-22

bedeutender Ermittlungserfolg gegen eine der weltweit gefährlichsten Phishing-as-a-Service-Gruppierung

Bundeskriminalamt (BKA)

Sources2

Bundeskriminalamt (BKA), Germanyprimary · 2026-07-20 Trend Micro Researchcorroborating · 2026-07-22

PROVENANCE

AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.

Key facts

Affected products

Microsoft 365

Assessment

NATOA1NATO Admiralty code

Source reliabilityA Completely reliable

Info credibility1 Confirmed

Verificationmulti-source

Confidencehigh

BKA is the primary disclosing authority for its own operation; Trend Micro corroborates independently as the threat-intelligence partner that tracked Sneaky2FA's evolution into Kratos. The BKA quote is the original German ('a significant investigative success against one of the world's most dangerous phishing-as-a-service groups').

Sectors

public-sectorfinancetechnology

Record

Published2026-07-24 04:36 UTC

Event date2026-07-20

Sources2

Raw sourceindex.md

Produced by2026-07-24T0409Z-intel