# German-US-Indonesian Law Enforcement Dismantle Kratos (aka SneakyLog / Sneaky 2FA) Phishing-as-a-Service Kit Targeting Microsoft 365 Sessions and MFA

> German (Frankfurt ZIT, BKA), US, and Indonesian authorities coordinated a takedown of Kratos, a phishing-as-a-service platform also tracked by Microsoft as SneakyLog and publicly linked to the Sneaky 2FA kit, taking 200+ servers offline and arresting the alleged Indonesian developer/technical administrator. The kit used an adversary-in-the-middle (AiTM) Node.js reverse-proxy mode to relay Microsoft 365 logins in real time and steal session cookies, bypassing MFA, and was sold via a Telegram-based franchise model to roughly 1,800 paying customers who ran an estimated 15,000 phishing campaigns per month against hundreds of thousands of potential victims (with ~850 confirmed) across 30-35 countries.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1612
- **ID:** TL-2026-1612
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** MITIGATED
- **Actor:** Kratos  PhaaS operator (Indonesia)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kratos is a phishing-as-a-service (PhaaS) platform that German prosecutors (Frankfurt am Main's Central Office for Combating Internet Crime, ZIT) and the Federal Criminal Police Office (BKA), working with US law enforcement and Indonesian authorities, dismantled in a coordinated operation announced July 22, 2026. Open-source and vendor reporting ties the 'Kratos' branding used by German authorities to phishing kits previously and concurrently sold under the names SneakyLog (Microsoft Threat Intelligence's tracking name) and Sneaky 2FA (first documented by Sekoia in December 2024). The platform is best understood as a 'digital construction kit' offered on a subscription/franchise basis: for roughly $200/month (with volume discounts), low-skill 'franchisee' customers received a fully-featured adversary-in-the-middle phishing kit capable of spoofing Microsoft 365, SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and Adobe authentication pages.

Technically, the kit shipped in two modes: (1) a plain PHP credential-harvesting page for simple password theft, and (2) a Node.js reverse-proxy mode that relays the victim's real-time authentication traffic to Microsoft's legitimate login endpoints, transparently forwarding password entry and any MFA/2FA challenge (Authenticator app, SMS, OTP) back to the victim, then capturing the resulting Microsoft 365 session cookie once authentication succeeds. Because the session token is stolen post-authentication, the kit fully bypasses conventional MFA — the operator can replay the harvested cookie to access the victim's mailbox and cloud services without ever possessing the password or a valid MFA response themselves. Source-code analysis (Sekoia, W3LL research lineage) shows Sneaky 2FA/SneakyLog incorporates code derived from the W3LL OV6 phishing kit, evidenced by identical GuzzleHttp cookie-handling and parsing functions, a shared unique UUID embedded in Microsoft-bound requests, and identical blurred-background PNG image hashes.

Operationally, the kit was distributed through a Telegram storefront (primary bot @SneakyLog_bot, with a dedicated support/ticketing bot @SneakySupport_bot) offering the core '365 Cookie Page' AiTM kit alongside adjacent tooling: a 'B2B Sender' bulk spam tool and redirect/attachment services. Payment was cryptocurrency-only (BTC, LTC, ETH, USDT-TRC20/BEP20), with fresh no-history addresses used for BTC/LTC and reused, high-transaction-count addresses for USDT/ETH — a pattern consistent with third-party laundering, reinforced by a roughly 10% payment premium.

The kit is heavily engineered to evade automated analysis and reduce detection: Cloudflare Turnstile CAPTCHA gating, anti-debugger JavaScript blocking browser DevTools, HTML/JS obfuscation via base64-embedded Microsoft branding assets and interspersed junk markup, IP/proxy-based traffic filtering that redirects suspected bots/scanners to benign decoy content (including food-themed pages and Wikipedia redirects via the href.li anonymization service), and a seven-step authentication relay flow (Turnstile challenge → email-based redirect → CAPTCHA → spoofed Microsoft 365 sign-in → password POST to /validate → 2FA method selection → session-token polling). Phishing pages themselves were hosted at URL paths using 150-character alphanumeric tokens followed by /index, /verify, or /validate, served from a mix of attacker-registered domains and compromised WordPress installations, deliberately intermixed with infrastructure shared by other unrelated AiTM kits to complicate attribution and takedown.

A distinctive detection artifact is the kit's inconsistent per-step User-Agent behavior: the initial login step presents an iPhone/Safari 13.0.3 User-Agent, while subsequent server-side authentication (SAS) calls to Microsoft present Chrome/Windows (BeginAuth), Firefox/macOS (ProcessAuth), and Edge/Windows (EndAuth) User-Agents against the same correlation ID within a short window — an 'impossible device shift' that Microsoft 365 audit-log correlation and community Sigma rules use for high-confidence, low-false-positive detection. A second published detection signature is the login page's characteristic paired-asset load of barr.svg and lg.svg immediately prior to POSTing credentials to next.php or save.php, reported at ~90% recall with near-zero false positives.

Microsoft Threat Intelligence has observed SneakyLog-driven campaigns since at least October 2024/early 2025, including a February 10, 2026 tax-season campaign that emailed roughly 100 US organizations in manufacturing, retail, and healthcare with a '2025 Employee Tax Docs' lure, a personalized '2025_Employee_W-2.docx' attachment, and QR codes embedding the recipient's email address to auto-populate the phishing landing page (autograb) — the kit supports both plaintext (#victim@example.com) and base64-encoded (a=<base64(email)>) autograb URL parameters. SneakyLog was one of several PhaaS kits (alongside the larger Energy365 and Tycoon2FA platforms) observed running tax-themed AiTM campaigns during the same window, indicating it competes in — but is not dominant within — the broader commercial PhaaS ecosystem.

The law enforcement action seized and null-routed 200+ servers, ending Kratos-supported campaigns' ability to execute, and resulted in the arrest of the platform's alleged developer/technical administrator in Indonesia. Officials estimate the operation generated 300,000+ (~$342,000 USD) in criminal revenue since operations began (reporting variably places kit origin between late 2024 and January 2026), ran roughly 15,000 monthly phishing campaigns against a potential victim pool of hundreds of thousands (with ~850 victims formally identified across 35 countries, concentrated in Europe and the United States), and served approximately 1,800 paying subscriber/franchisee accounts. BKA cybercrime chief Carsten Meywirth stated: 'Anyone who steals login credentials online using fake websites shouldn't feel safe.' Despite the takedown, the ~1,800 customers retain kit source code and Telegram access, and investigators expect the operation — or its customer base — to resurface under new branding, consistent with prior PhaaS takedowns (e.g., 16shop, LabHost).

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1566 Phishing
- T1199 Trusted Relationship
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1606 Forge Web Credentials
- T1056 Input Capture
- T1556 Modify Authentication Process
- T1027 Obfuscated Files or Information
- T1684.001 Impersonation
- T1102 Web Service
- T1036 Masquerading
- T1070 Indicator Removal
- T1098 Account Manipulation
- T1114 Email Collection
- T1526 Cloud Service Discovery
- T1087 Account Discovery
- T1213 Data from Information Repositories
- T1090 Proxy
- T1102 Web Service
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal

## Sources

- [Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA](https://thehackernews.com/2026/07/police-dismantle-kratos-phishing-kit.html)
- [Kratos phishing-as-a-service kit loses its battle with international law enforcement](https://www.theregister.com/security/2026/07/21/german-authorities-lead-takedown-of-kratos-phishing-platform/5275666)
- [Police Dismantle Kratos Phishing-as-a-Service Platform and Take Down Over 200 Servers](https://gbhackers.com/police-dismantle-kratos-phishing-as-a-service-platform/)
- [BKA: Erfolgreicher Schlag gegen eine der weltweit gefährlichsten Phishing-Gruppierungen](https://www.presseportal.de/blaulicht/pm/7/6318131)
- [Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service](https://www.sekoia.com/blog/sneaky-2fa-exposing-a-new-aitm-phishing-as-a-service/)
- [When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures](https://www.microsoft.com/en-us/security/blog/2026/03/19/when-tax-season-becomes-cyberattack-season-phishing-and-malware-campaigns-using-tax-related-lures/)
- [Kratos PhaaS Targets US and EU: How to Reduce Microsoft 365 Account Takeover Risk](https://medium.com/@anyrun/kratos-phaas-targets-us-and-eu-how-to-reduce-microsoft-365-account-takeover-risk-5696ddc8ab09)
- [Sneaky Log Phishing Scheme Targets Two-Factor Security](https://www.techrepublic.com/article/sneaky-log-microsoft-phishing-2fa/)
- ['Sneaky Log' phishing kits slip by Microsoft 365 accounts](https://www.scworld.com/news/sneaky-log-phishing-kits-slip-by-microsoft-365-accounts)
- [Sneaky Log Phishing-as-a-Service](https://www.cyber.nj.gov/Home/Components/News/News/1745/214)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1612