# Kratos Phishing-as-a-Service Platform Targeting Microsoft 365 Users Across US and Europe

> Kratos is an actively evolving phishing-as-a-service (PhaaS) kit that impersonates Microsoft 365 (and formerly Adobe Creative Cloud/Document Cloud) login flows, using Cloudflare Turnstile/reCAPTCHA/hCaptcha anti-bot gates, SharePoint/OneDrive/Canva/Tilda/systeme.io lure hosting, and Telegram-bot credential exfiltration to compromise organizations in 20+ countries.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1408
- **ID:** TL-2026-1408
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kratos is a subscription-based Phishing-as-a-Service (PhaaS) platform first observed operating an admin panel since at least September 10, 2025, with its phishing kit visible in ANY.RUN's Interactive Sandbox from January 2026 onward and continued activity through the July 2026 reporting window. The kit has evolved across at least three tracked generations: V0 ('PTT/SOft', a 'Secure File Access' lure with blurred invoice background, exfiltrating to mini.php under a /PTT/SOft/ path, seen on the dwbud.vilaribit.com domain and associated with only 9 sandbox sessions); V1 (the dominant generation with 1,397 identified sandbox sessions, using a shared asset fingerprint of barr.svg + lg.svg + ani.gif + res.css + styles.css, a fake Microsoft sign-in page with an animated envelope and 'Loading in progress...' splash screen, and exfiltration to next.php/nex.php/n3xt.php/officers*eur.php); and V2 (the current generation, 231 sessions, using dsa.svg + sid.gif + imag.jpg + main.js assets, jQuery 4.0 beta with obfuscated JavaScript, and exfiltration via fetch() calls to save.php). Across V1 and V2 combined, ANY.RUN identified 1,628 sandbox sessions, of which only 156 had previously been manually attributed to Kratos and 1,484 were previously unattributed to any known family — with a distinct SHA-256 shared styles.css asset connecting 636 of those tasks. A separate, harder-to-detect campaign variant observed roughly 100+ analysis sessions in a single week, replacing the static /SOft URI and 'Secure Document Access' branding with common-looking URIs and a more realistic Microsoft-style authentication interface targeting manufacturing, technology, and MSSP organizations.

The attack chain begins with phishing emails using document-share, invoice-review, and DocuSign-pending-action lures, frequently staged through legitimate cloud services (SharePoint/OneDrive account for 351 observed delivery tasks, alongside Microsoft Forms, Canva, Tilda, and systeme.io) to slip past corporate email filters — 114 observed sessions successfully bypassed email security controls. Clicking the lure routes the victim through a Cloudflare Turnstile (also seen as 'challengepoint' in traffic, alongside reCAPTCHA and hCaptcha as operator-selectable alternatives) anti-bot verification screen intended to filter out sandboxes, crawlers, and automated analysis tools before the fake Microsoft authentication page is rendered. The credential form uses DOMPurify 3.2.6 for client-side sanitization and, on submission, POSTs harvested email/password pairs (in di and pr parameters) to the generation-specific exfiltration endpoint. To increase victim-perceived legitimacy and harvest additional password attempts, the kit displays a fake 'Incorrect Password' message (an #pass-err element) after the first submission, capturing up to three password attempts before redirecting the victim to the legitimate office.com — making the incident appear to the victim as a failed login rather than a successful credential theft. Harvested data is exfiltrated in JSON format via a Telegram bot (api.telegram.org) for real-time, encrypted collection, with some sessions also observed establishing WebSocket connections, which may indicate live credential relaying or adversary-in-the-middle positioning, though this is not fully confirmed.

The Kratos operator admin panel is protected by a master password plus Telegram-based two-factor authentication, and provides operators a dashboard with user/sales statistics, a deploy.* subdomain for rapid stand-up of new phishing domains, choice of a PHP-based Office 365 template or a Node.js reverse proxy with built-in anti-bot capabilities, automated SSL certificate issuance and DNS management, and API endpoints under /vps/* and /domains/* for infrastructure automation — indicating a fully industrialized, subscription-driven cybercrime-as-a-service operation. ANY.RUN attributes a likely Egypt-based operator IP (41.128.0.142) associated with the panel's traffic. Victimology spans more than 20 countries, concentrated in the United States (~33% of observed activity) and Southern Europe (notably Spain), with 148 suspected victim organizations identified via SharePoint tenant-name analysis, spanning SMBs, law firms, schools, polytechnics/educational institutions, industrial firms, manufacturing, technology companies, MSSPs, and public institutions. ANY.RUN's asset-cofingerprinting detection approach (co-occurrence of barr.svg + lg.svg for V1, or dsa.svg + sid.gif + imag.jpg for V2 in the same session) achieves approximately 90% detection recall with near-zero false positives.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1566 Phishing
- T1598 Phishing for Information
- T1204 User Execution
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1684.001 Impersonation
- T1187 Forced Authentication
- T1056 Input Capture
- T1110 Brute Force
- T1119 Automated Collection
- T1102 Web Service
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal

## Sources

- [Kratos PhaaS Attacking Microsoft 365 Users](https://cybersecuritynews.com/kratos-phaas-attacking-microsoft-365-users/)
- [Kratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk](https://medium.com/@anyrun/kratos-phaas-targets-us-and-eu-how-to-reduce-microsoft-365-account-takeover-risk-5696ddc8ab09)
- [New Kratos PhaaS Campaign Attack Organizations with a Harder-to-Detect Phishing Flow](https://cyberpress.org/new-kratos-phaas-campaign-attack-organizations-with-a-harder-to-detect-phishing-flow/)
- [The Rise of Kratos: How the New Phishing-as-a-Service Kit Industrializes Cybercrime](https://blog.knowbe4.com/the-rise-of-kratos-how-the-new-phishing-as-a-service-kit-industrializes-cybercrime)
- [Kali365: Anatomy of a Microsoft 365 Phishing-as-a-Service Kit](https://spycloud.com/blog/kali365-anatomy-of-a-microsoft365-phishing-as-a-service-kit/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1408