# German-Led Takedown of Kratos (SneakyLog/Sneaky 2FA) Phishing-as-a-Service Platform Bypassing MFA via AiTM Session-Cookie Theft

> German authorities (Frankfurt ZIT, BKA), supported by US law enforcement and Microsoft, dismantled Kratos — also known as SneakyLog and Sneaky 2FA — an adversary-in-the-middle phishing-as-a-service platform that harvested Microsoft 365 credentials and session cookies to bypass MFA. Roughly 1,800 criminal customers ran ~15,000 phishing campaigns per month against victims in 30+ countries; over 200 servers were seized and the alleged developer was arrested in Indonesia.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1602
- **ID:** TL-2026-1602
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** MITIGATED
- **Actor:** Kratos
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kratos is a phishing-as-a-service (PhaaS) kit that evolved from an earlier family of commercial trojans and infostealers into a subscription-based adversary-in-the-middle (AiTM) platform marketed under the names SneakyLog and Sneaky 2FA. Sold via a Telegram bot (@SneakyLog_bot) for roughly $200/month with volume discounts, the kit lets low-skill criminals stand up convincing Microsoft 365-themed login pages (branded 'Login', 'SharePoint', 'OneDrive', 'Microsoft Forms', plus Canva/Tilda/Adobe templates) that proxy the victim's real authentication flow. By relaying the victim's credentials and one-time MFA codes to Microsoft's real login endpoint in real time and capturing the resulting session cookie, operators bypass MFA entirely and hijack authenticated sessions.

The kit incorporates code lineage from the W3LL OV6 AiTM toolkit (first reported by Group-IB in September 2023), sharing identical GuzzleHttp-based cookie-handling and parsing routines and identical blurred Outlook/Excel/OneDrive/SharePoint background images, with an embedded reference to the W3LL domain w3ll[.]store in the authentication relay code. Sneaky 2FA phishing pages first appeared circulating from at least October 2024, were formally identified by Sekoia in December 2024, and Microsoft observed a large-scale W-2/tax-themed campaign (subject: '2025 Employee Tax Docs', attachment 2025_Employee_W-2.docx with a per-recipient QR code) hit roughly 100 US manufacturing, retail, and healthcare organizations on February 10, 2026.

Operationally, the kit uses Cloudflare Turnstile CAPTCHAs to gate the phishing page, filters out datacenter/VPN/security-scanner traffic by redirecting it to benign Wikipedia pages via the href.li anonymizer, displays decoy food-themed HTML during page reloads, obfuscates visible text with interleaved empty anchor tags, base64-encodes images and the spoofed Microsoft favicon, randomizes page titles from a pool of 'Verify/Confirm'-themed strings, and generates 150-character alphanumeric URL paths. A hallmark AiTM tell is that each step of the Microsoft authentication flow (Login:login, SAS:BeginAuth, SAS:ProcessAuth, SAS:EndAuth/Kmsi:kmsi) is relayed with a different hardcoded User-Agent string spanning iOS Safari, Windows Chrome, macOS Firefox, and Windows Edge — inconsistent with a single real device completing one authentication session. Successful sessions were observed redirecting victims to a decoy Outlook error page (outlook.office365[.]com/Encryption/ErrorPage.aspx) to mask the compromise. The operator's back-end license-check server communicated with phishing nodes over HTTP to validate active Sneaky Log subscriptions before serving pages, and cryptocurrency payments (BTC, ETH, LTC, USDT-TRC20/BEP20) were laundered through a fresh-address/overpayment scheme suggestive of a third-party mixing service.

On 2026-07-20/21, Frankfurt's Central Office for Combating Internet Crime (ZIT) and Germany's Federal Criminal Police Office (BKA), working with US law enforcement, Indonesian authorities, and Microsoft, seized more than 200 Kratos servers, transferred seized domains to FBI control with a seizure banner, and arrested the alleged developer/technical administrator in Indonesia. BKA characterized Kratos as 'one of the world's most widely used criminal phishing services,' with confirmed victims in 30-35+ countries (concentrated in the US and Europe) and estimated proceeds exceeding €300,000 (~$342,000) since 2024. Target sectors included US manufacturing, retail, and healthcare organizations, and European industrial firms, law firms, polytechnic institutes, schools, and SMBs.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1566 Phishing
- T1078 Valid Accounts
- T1204 User Execution
- T1098 Account Manipulation
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1621 Multi-Factor Authentication Request Generation
- T1056 Input Capture
- T1606 Forge Web Credentials
- T1027 Obfuscated Files or Information
- T1684.001 Impersonation
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1102 Web Service
- T1016 System Network Configuration Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1090 Proxy
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [German authorities lead takedown of Kratos phishing platform](https://www.theregister.com/security/2026/07/21/german-authorities-lead-takedown-of-kratos-phishing-platform/5275666)
- [Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service](https://www.sekoia.com/blog/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/)
- [New 'Sneaky 2FA' Phishing Kit Targets Microsoft 365 Accounts with 2FA Code Bypass](https://thehackernews.com/2025/01/new-sneaky-2fa-phishing-kit-targets.html)
- [When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures](https://www.microsoft.com/en-us/security/blog/2026/03/19/when-tax-season-becomes-cyberattack-season-phishing-and-malware-campaigns-using-tax-related-lures/)
- [The Rise of Kratos: How the New Phishing-as-a-Service Kit Industrializes Cybercrime](https://blog.knowbe4.com/the-rise-of-kratos-how-the-new-phishing-as-a-service-kit-industrializes-cybercrime)
- [German authorities dismantle Kratos phishing-as-a-service infrastructure](https://www.scworld.com/brief/german-authorities-dismantle-kratos-phishing-as-a-service-infrastructure)
- [Microsoft, Europol take down global phishing as a service network which was able to bypass 2FA with ease](https://www.techradar.com/pro/security/microsoft-europol-take-down-global-phishing-as-a-service-network-which-was-able-to-bypass-2fa-with-ease)
- ['Sneaky Log' phishing kits slip by Microsoft 365 accounts](https://www.scworld.com/news/sneaky-log-phishing-kits-slip-by-microsoft-365-accounts)
- [Sneaky 2FA Malware Analysis, Overview by ANY.RUN](https://any.run/malware-trends/sneaky2fa/)
- [Sneaky Log Phishing-as-a-Service](https://www.cyber.nj.gov/Home/Components/News/News/1745/214)
- [Microsoft Warns IRS Phishing Hits 29,000 Users, Deploys RMM Malware](https://thehackernews.com/2026/03/microsoft-warns-irs-phishing-hits-29000.html)
- [Police dismantle Kratos phishing platform, arrest developer](https://nsaneforums.com/news/security-privacy-news/police-dismantle-kratos-phishing-platform-arrest-developer-r35897)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1602