# Kratos Phishing-as-a-Service Platform Dismantled in Operation Olympus Blade — BKA/FBI/Indonesian Police Takedown of AiTM Microsoft 365 Credential Theft Kit

> German (BKA/ZIT Frankfurt), US, and Indonesian law enforcement dismantled Kratos, a Node.js-based AiTM (adversary-in-the-middle) phishing-as-a-service platform sold via a website and Telegram shop that let over 1,800 criminal franchisees run roughly 15,000 Microsoft 365-themed credential-and-session-cookie theft campaigns per month against victims in 30-35 countries. Authorities seized 200+ servers and arrested the alleged developer/administrator in Indonesia; the operator had earned at least €300,000 in subscription revenue since 2024.

- **Published:** 2026-07-22T00:00:00Z
- **Last reviewed:** 2026-07-22T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1613
- **ID:** TL-2026-1613
- **Severity:** MEDIUM
- **Category:** CAMPAIGN
- **Status:** MITIGATED
- **Actor:** Kratos PhaaS Operator
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kratos is a Phishing-as-a-Service (PhaaS) platform, active since at least September 2025 (with kit-lineage tracing back further under aliases SneakyLog/Sneaky 2FA), that industrialized adversary-in-the-middle (AiTM) credential and session theft against Microsoft 365 accounts. Operators purchased subscription access via a dedicated website and a Telegram-based shop, then used a central operator dashboard to configure and launch campaigns without needing to write or host any phishing code themselves — 'even low-skill actors could point a working AiTM kit at a target,' per reporting.

The kit offered operators a choice of two delivery modes from its 'Deploy' subdomain: a simpler PHP-based static Office 365 credential-harvesting page, or a Node.js reverse-proxy server that relays the victim's real-time login transaction to Microsoft's actual authentication endpoints (login.live.com / microsoftonline.com) while transparently capturing the resulting authenticated session cookie. Because the proxy relays a genuine Microsoft authentication flow, any MFA challenge the victim completes is satisfied against the real Microsoft service — the operator never needs to defeat MFA directly, only to capture the session cookie issued at the end of the transaction. That cookie alone is sufficient to assume the victim's authenticated session (T1550.004 Use Alternate Authentication Material: Web Session Cookie), which survives password resets and requires explicit session/token revocation to remediate.

Lures were highly varied and multi-staged: phishing emails impersonated document-sharing and productivity notifications ('User N has shared a document with you', 'Sign the document via DocuSign', 'An invoice has been sent', 'Notice of charge - [6-digit number]'), often routed victims through trusted intermediary platforms (SharePoint, OneDrive, Canva, Tilda, Microsoft Forms) before redirecting to the actual phishing page, and used six distinct payload delivery mechanisms: direct links, personalized QR codes (including QR codes embedded in fake W-2 tax documents in a February 10 campaign targeting ~100 US manufacturing/retail/healthcare organizations), weaponized HTML/SVG attachments, ICS calendar invites, RFC-compliant EML files, and PDF/DOCX documents with embedded QR codes. Adobe Creative Cloud/Document Cloud invoice-urgency lures were also used as a secondary brand alongside the primary Microsoft 365 theme.

The kit built in substantial anti-analysis and anti-bot tradecraft: CAPTCHA gating (Cloudflare Turnstile, reCAPTCHA, hCaptcha) to filter sandboxes and automated scanners before serving the real phishing payload; an animated 'Loading in progress…' envelope overlay on a blurred fake document as a visual fingerprint/stall; three-attempt password-entry limiting before redirecting away; geographic/device-type victim filtering via geoplugin.net and VPN/proxy detection; obfuscated JavaScript (a 'V2' generation of the kit); and dynamic domain generation across low-cost TLDs (.horse, .cfd, .sbs, .online) plus abuse of compromised legitimate WordPress sites (observed German .de and Spanish .es domains) and Cloudflare-fronted infrastructure to mask origin hosting. Backend hosting spanned Azure, Google Cloud, and the bulletproof/VPS provider Host4Geeks. Stolen data was exfiltrated to operators via Telegram bot API (api.telegram.org) — blending exfiltration traffic with legitimate encrypted Telegram traffic to evade DPI — or delivered as JSON via email; the operator panel itself was protected by a master password plus Telegram-based 2FA. The architecture was described as 'decoupled,' separating the victim-facing phishing front end from backend credential storage so harvested data remained accessible even after individual phishing URLs were taken down.

Security researchers identified a durable, high-confidence detection signature: Kratos login pages consistently load a paired pair of static assets, barr.svg and lg.svg, and POST stolen credentials to predictable backend endpoints that evolved across kit versions (V0: */PTT/SOft/mini.php; V1: */next.php, */nex.php, */n3xt.php; V2: */save.php) — a pattern researchers reported achieving ~90% recall with a near-zero false-positive rate. Kratos infrastructure was also observed sharing hosting with other AiTM PhaaS kits in the same criminal ecosystem, including Tycoon (Tycoon2FA), Flowerstorm, Sneaky2FA, and EvilProxy.

By law enforcement's account, the platform's ~1,800 paying criminal subscribers launched approximately 15,000 phishing campaigns per month, generating hundreds of thousands of victims across 30-35 countries (concentrated in Southern Europe, particularly Spain, as well as the US); one law-enforcement figure put confirmed identified victims at approximately 850 across 35 countries, with targeted sectors including manufacturing, retail, and healthcare in the US and industrial, legal, and education verticals in Europe. The operation, publicly branded by investigators as 'Operation Olympus Blade,' was led by Frankfurt's Central Office for Combating Internet Crime (ZIT) and Germany's Federal Criminal Police Office (BKA), supported by US law enforcement (FBI), with the arrest of the alleged Kratos developer/administrator physically executed by Indonesian police. More than 200 servers supporting the platform were seized/nulled, and the FBI took over ownership of the seized Kratos website domain, replacing it with a law-enforcement seizure banner. Authorities estimated the operator earned at least €300,000 (~$342,000) in subscription revenue since 2024. ZIT head Dr. Benjamin Krause stated the takedown reflected a strategy of 'disruptive law enforcement,' and BKA cybercrime head Carsten Meywirth warned that 'anyone who steals login credentials online using fake websites shouldn't feel safe.'

The takedown disrupted Kratos's central infrastructure and its administrator, but law enforcement acknowledged this does not eliminate the platform's roughly 1,800 existing customers, who retain copies of kit code and may migrate to sibling AiTM kits (Tycoon2FA, Sneaky2FA, EvilProxy, Flowerstorm) that already share infrastructure with Kratos. Defensive recommendations from responders center on phishing-resistant MFA (FIDO2/WebAuthn passkeys, which are immune to session-cookie-relay AiTM attacks because they are bound to the origin), monitoring for anomalous Microsoft 365 sign-in patterns (impossible travel, new device/session anomalies), auditing for suspicious OAuth application grants and inbox/mailbox rule changes (common BEC follow-on indicators after session hijack), and blocking/monitoring the identified static-asset and endpoint signatures at the web-proxy/EDR layer.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1566 Phishing
- T1199 Trusted Relationship
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1056 Input Capture
- T1111 Multi-Factor Authentication Interception
- T1550 Use Alternate Authentication Material
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1684.001 Impersonation
- T1090 Proxy
- T1098 Account Manipulation
- T1078 Valid Accounts
- T1119 Automated Collection
- T1071 Application Layer Protocol
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal

## Sources

- [BKA, FBI dismantle Kratos phishing platform](https://www.helpnetsecurity.com/2026/07/22/bka-fbi-kratos-phishing-platform-takedown/)
- [Police dismantle Kratos phishing platform, arrest developer](https://www.hendryadrian.com/police-dismantle-kratos-phishing-platform-arrest-developer/)
- [Kratos phishing-as-a-service kit loses its battle with international law enforcement](https://www.theregister.com/security/2026/07/21/german-authorities-lead-takedown-of-kratos-phishing-platform/5275666)
- [Police Dismantle Kratos Phishing-as-a-Service Platform and Take Down Over 200 Servers](https://gbhackers.com/police-dismantle-kratos-phishing-as-a-service-platform/)
- [Police dismantle Kratos phishing platform, arrest developer - Security & Privacy News](https://nsaneforums.com/news/security-privacy-news/police-dismantle-kratos-phishing-platform-arrest-developer-r35897)
- [German authorities dismantle Kratos phishing-as-a-service infrastructure](https://www.scworld.com/brief/german-authorities-dismantle-kratos-phishing-as-a-service-infrastructure)
- [The Rise of Kratos: How the New Phishing-as-a-Service Kit Industrializes Cybercrime](https://blog.knowbe4.com/the-rise-of-kratos-how-the-new-phishing-as-a-service-kit-industrializes-cybercrime)
- [Kratos PhaaS Targets US and EU Companies](https://any.run/cybersecurity-blog/kratos-phaas-account-takeover/)
- [Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA](https://thehackernews.com/2026/07/police-dismantle-kratos-phishing-kit.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1613