Global Law Enforcement Dismantles Major Phishing-as-a-Service Operation

Key Takeaways

• Global law enforcement has dismantled “Kratos,” a major phishing-as-a-service (PaaS) operation.
• Kratos facilitated approximately 15,000 monthly phishing campaigns, primarily targeting Microsoft credentials.
• The operation led to the arrest of a key administrator and the neutralization of over 200 servers.
• Over 850 victims across 35 countries have been identified, with the actual number of affected users potentially much higher.

International law enforcement agencies have successfully disrupted Kratos, a significant phishing-as-a-service (PaaS) provider responsible for orchestrating roughly 15,000 phishing campaigns each month. This coordinated effort has effectively dismantled a global infrastructure that enabled widespread credential theft.

The collaborative operation involved German law enforcement, working alongside authorities in the United States and Indonesia. A critical arrest was made in Indonesia, where the alleged developer and technical administrator of the Kratos infrastructure was apprehended.

Investigators further neutralized more than 200 servers linked to the service, identifying approximately 850 victims spread across 35 nations, predominantly in Europe and the United States. It is important to note that the actual number of individuals targeted by Kratos-powered campaigns could be substantially higher, given that individual phishing attempts often reach thousands of potential victims.

Kratos: A Digital Toolkit for Cybercrime

How the Kratos Phishing-as-a-Service Operated

Kratos functioned as a “digital construction kit” for cybercriminals, offering an accessible toolkit that allowed subscribers to develop and manage sophisticated phishing pages. These pages were meticulously designed to mimic legitimate Microsoft authentication portals, making them highly deceptive.

Unsuspecting victims who entered their email addresses, passwords, or other personal data into these fraudulent login forms unknowingly surrendered their credentials directly to the attackers. The theft of Microsoft account credentials can pave the way for a cascade of subsequent attacks, including business email compromise (BEC), unauthorized cloud access, full account takeover, internal phishing schemes, financial fraud, and data exfiltration.

Phishing lures themed around Microsoft services are particularly potent due to the pervasive use of platforms like Microsoft 365 by businesses, public sector entities, and individual consumers globally.

Business Model and Impact

The Kratos platform operated on a phishing-as-a-service model, leasing its capabilities to other criminals. This significantly lowered the technical barrier for aspiring attackers, enabling individuals without the advanced skills to develop their own phishing infrastructure to launch professional-looking campaigns.

Authorities estimate that over 1,800 criminal customers purchased access to Kratos. The service is believed to have generated more than €300,000 in revenue since 2024, fueling approximately 15,000 phishing campaigns every month.

The recent takedown specifically targeted the core technical components of the Kratos ecosystem, moving beyond simply shutting down individual phishing websites. By eliminating the service’s underlying server infrastructure and arresting its technical administrator, investigators have achieved a comprehensive shutdown of all Kratos-supported campaigns.

The BKA has described this operation as a significant victory against one of the world’s most dangerous phishing-as-a-service groups. With the Kratos infrastructure now disabled, its former clients can no longer leverage the platform to conduct their illicit campaigns, thereby preventing further credential theft and potential downstream fraud. The BKA emphasizes that phishing has evolved into an industrialized crime, with ready-made platforms offering templates, hosting, and support for scalable operations.

What You Should Do

• Organizations should continue to treat Microsoft login prompts, password reset notifications, and shared document alerts as high-risk phishing themes.
• Implement and enforce phishing-resistant multi-factor authentication (MFA) across all accounts.
• Actively monitor for suspicious sign-in activity and unusual account behavior.
• Block newly registered or lookalike domains that could be used for phishing attacks.
• Conduct regular user training to educate employees on how to identify phishing attempts and verify login URLs before entering any credentials.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.