# International Law Enforcement Dismantles Kratos (SneakyLog/Sneaky 2FA) Phishing-as-a-Service Platform Behind 15,000 Monthly Microsoft 365 Credential-Harvesting Campaigns

> Germany's BKA and the Frankfurt ZIT, working with U.S. and Indonesian authorities, dismantled Kratos — a subscription-based phishing-as-a-service (PhaaS) platform also marketed as SneakyLog/Sneaky 2FA that generated adversary-in-the-middle counterfeit Microsoft 365 login pages to steal credentials, session cookies, and MFA tokens. The takedown neutralized over 200 servers and led to the arrest of the platform's developer/administrator in Indonesia; roughly 1,800 criminal subscribers had used the kit since 2020 to run ~15,000 monthly campaigns against an estimated 850 victims in 35 countries.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1608
- **ID:** TL-2026-1608
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** RESOLVED
- **Actor:** Kratos PhaaS developer
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kratos was a criminal 'digital construction kit' — a phishing-as-a-service (PhaaS) offering that lowered the technical barrier for account-takeover fraud by leasing ready-made, adversary-in-the-middle (AiTM) capable phishing infrastructure to subscribers. Operating from 2020 through 2024 and generating over €300,000 in sales/subscription revenue, the platform is estimated to have onboarded more than 1,800 criminal customers who together launched approximately 15,000 phishing campaigns per month. Independent technical analysis (ANY.RUN sandbox telemetry, cross-referenced with KnowBe4 and Microsoft reporting under the aliases 'SneakyLog' and 'Sneaky 2FA') documented three generations of the kit (V0/PTT-SOft, V1, V2), each replicating Microsoft 365/Azure AD authentication flows and associated services (SharePoint, OneDrive, Microsoft Forms) to harvest usernames, passwords, and session cookies capable of bypassing multi-factor authentication.

Victims were lured via emails impersonating document-sharing notifications, DocuSign, and invoice/billing alerts, frequently staged through abused legitimate SaaS intermediaries (SharePoint, OneDrive, Canva, Tilda, systeme.io, Adobe, Microsoft Forms) to evade corporate email filters, and delivered via QR codes, ICS calendar invites, EML attachments, and weaponized PDF/DOCX lures. The kit's admin panel let operators choose between a PHP-based Office 365 impersonation page or a Node.js redirect server with built-in anti-bot protection, deploy domains, upload files, install SSL certificates, and modify DNS — protected by a master password plus Telegram-based two-factor authentication (in use since at least September 10, 2025). Anti-analysis measures included Cloudflare Turnstile/reCAPTCHA/hCaptcha challenges, geolocation/device filtering via geoplugin.net, and a hard three-attempt password limit designed to defeat automated sandboxes while still harvesting real credentials from human victims. Harvested credentials were packaged as JSON and exfiltrated via the Telegram Bot API, keeping stolen data available to operators even after infrastructure takedowns.

Infrastructure relied on disposable domains registered on low-cost TLDs (.horse, .cfd, .sbs, .today, .fit, .online) alongside compromised legitimate WordPress sites (concentrated in German .de and Spanish .es domains), fronted by Cloudflare to mask true origin hosting across Azure, Google Cloud, and Host4Geeks. Sandbox telemetry logged 1,628 phishing sessions across 20+ countries, with 148 suspected victim organizations identified via harvested SharePoint tenant names; targeting concentrated on SMBs, law firms, schools/polytechnics, and industrial organizations in Europe (notably Spain, evidenced by Spanish-language lure tokens such as 'factura', 'abogados', 'dgt') and manufacturing, retail, and healthcare organizations in the United States. The July 2026 operation — the result of a joint BKA/ZIT (Frankfurt Central Office for Combating Internet Crime)/U.S./Indonesian investigation — seized over 200 servers and arrested Kratos's alleged developer and technical administrator in Indonesia, with BKA cybercrime chief Carsten Meywirth and ZIT head Benjamin Krause publicly confirming the platform's central infrastructure has been disrupted such that Kratos-supported campaigns can no longer be executed.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1608 Stage Capabilities
- T1566 Phishing
- T1598 Phishing for Information
- T1204 User Execution
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1557 Adversary-in-the-Middle
- T1528 Steal Application Access Token
- T1087 Account Discovery
- T1119 Automated Collection
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal

## Sources

- [Police Dismantle Kratos Phishing-as-a-Service Platform](https://gbhackers.com/police-dismantle-kratos-phishing-as-a-service-platform/)
- [Kratos phishing-as-a-service kit loses its battle with international law enforcement](https://www.theregister.com/security/2026/07/21/german-authorities-lead-takedown-of-kratos-phishing-platform/5275666)
- [Kratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk](https://medium.com/@anyrun/kratos-phaas-targets-us-and-eu-how-to-reduce-microsoft-365-account-takeover-risk-5696ddc8ab09)
- [The Rise of Kratos: How the New Phishing-as-a-Service Kit Industrializes Cybercrime](https://blog.knowbe4.com/the-rise-of-kratos-how-the-new-phishing-as-a-service-kit-industrializes-cybercrime)
- [BKA Pressemitteilung: Erfolgreicher Schlag gegen eine der weltweit gefährlichsten Phishing-Gruppierungen](https://www.bka.de/SharedDocs/Pressemitteilungen/DE/Presse_2026/pm260720_Kratos.pdf?__blob=publicationFile&v=2)
- [German authorities dismantle Kratos phishing-as-a-service infrastructure](https://www.scworld.com/brief/german-authorities-dismantle-kratos-phishing-as-a-service-infrastructure)
- [Police dismantle Kratos phishing platform, arrest developer](https://nsaneforums.com/news/security-privacy-news/police-dismantle-kratos-phishing-platform-arrest-developer-r35897)
- [Police dismantle Kratos phishing platform, arrest developer](https://www.hendryadrian.com/police-dismantle-kratos-phishing-platform-arrest-developer/)
- [Erfolgreicher Schlag gegen eine der weltweit gefährlichsten Phishing-Gruppierungen](https://www.tempelhof-schoeneberg-zeitung.de/erfolgreicher-schlag-gegen-eine-der-weltweit-gefaehrlichsten-phishing-gruppierungen/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1608