German and US Law Enforcement Dismantle "Kratos" Phishing-as-a-Service Platform; Indonesian Arrest Made

A widely used phishing-as-a-service platform loses its infrastructure and its alleged operator — but the Microsoft 365 exposure it industrialized outlives any single takedown.

FRANKFURT — German and United States law enforcement on July 21–22, 2026 dismantled the core infrastructure of "Kratos," a platform German investigators describe as one of the world's most widely used criminal phishing kits, while Indonesian authorities arrested the man who reportedly developed and administered it. Investigators reportedly seized more than 200 servers in the coordinated action.

The takedown targeted phishing-as-a-service (PhaaS) — a subscription model in which a technical operator maintains the phishing infrastructure and rents it to other criminals — and it names a specific victim population: Microsoft 365 customers. As reported by The Hacker News and The Register, Kratos was built to spin up counterfeit Microsoft sign-in pages and reportedly targeted Microsoft 365 sessions in a manner designed to defeat MFA. This piece summarizes what authorities announced and what it means for defender teams, without reconstructing how the kit worked.

What Law Enforcement Announced

According to reporting from The Hacker News, the German side of the operation was led by the Central Office for Combating Internet Crime (ZIT) at the Frankfurt am Main public prosecutor's office and Germany's Federal Criminal Police Office (BKA, or Bundeskriminalamt), working with US authorities. Investigators reportedly seized more than 200 servers that made up the platform's core infrastructure, and Indonesian authorities arrested the man alleged to have developed and technically administered the service. The arrested individual has not been publicly named in the reporting reviewed, and The CyberSignal is not naming him.

German investigators characterized Kratos as one of the world's most widely used criminal phishing kits — a "digital construction kit," in the reporting's phrasing, that let paying subscribers stand up and manage convincing fake Microsoft sign-in pages without building the infrastructure themselves. That subscription structure is what puts the kit in the phishing-as-a-service category: one operator maintains the tooling and hosting, and a large customer base rents it.

Reporting attaches several scale figures to the platform, which The CyberSignal presents as investigators' estimates rather than settled facts. Kratos was reportedly used to run on the order of 15,000 phishing campaigns per month, drew an estimated customer base in the low thousands, and is tied to roughly 850 identified victims across some 35 countries, most in Europe and the United States, with the operation said to have earned in excess of €300,000 since 2024. Some accounts describe a far larger pool of people targeted; the precise totals, and the platform's full customer count, are not confirmed and are treated here as approximate.

The Microsoft 365 and MFA-Bypass Angle, in Defender Terms

The detail most relevant to defender teams is the target class. Kratos was reportedly built specifically to imitate Microsoft sign-in pages and to go after Microsoft 365 sessions — and, per reporting, it was designed to get past multi-factor authentication rather than to stop at a stolen password. The CyberSignal is deliberately not reconstructing how that was accomplished; the defender-relevant fact is the class of the threat, not its mechanics.

In plain terms, this is the family of phishing that assumes MFA is already in place and is engineered to work around it, typically by going after the authenticated session that sits behind the login rather than the credential alone. That is precisely the scenario that phishing- and session-theft-resistant controls are meant to blunt. Restated as a posture question rather than a technical one: a defender should assume that a stolen password plus a one-time code is not, on its own, a sufficient barrier against this kind of kit, and should weight controls accordingly.

It is worth stating plainly what this framing does not mean. The takedown does not imply that Microsoft 365 was breached at the platform level, nor that MFA is broadly ineffective; the reported exposure is the credential-and-session theft that a convincing fake login page can enable against an individual account. That distinction matters for how a defender team scopes its response — the unit of risk here is the account and its live session, not the identity provider as a whole.

Continuation Context: The PhaaS Thread

Kratos does not arrive in isolation. It is the latest entry in a running thread The CyberSignal has tracked, in which criminal phishing has professionalized into a rented service aimed squarely at Microsoft 365. The pattern is visible in earlier coverage of the Forg365 device-code and adversary-in-the-middle PhaaS platform and in the resurgence of the Tycoon2FA kit, which turned Microsoft's own login page against M365 accounts. Each shares Kratos's shape: an operator maintaining the tooling, a customer base renting it, and Microsoft 365 as the prize.

The enforcement response has a thread of its own. Server-seizure takedowns of criminal service platforms have become a recurring tactic — seen in operations such as Europol's Operation Endgame 2.0, which pulled down 300 servers and named 20 operators of the ransomware supply chain, and in Microsoft's takedown of a code-signing-as-a-service operation whose customers were ransomware crews. The Kratos action fits that mold: hit the shared infrastructure and, where possible, the operator behind it.

Defender Takeaways for Microsoft 365 Customers

Because Microsoft 365 is the named target class, the practical response is a short sector-advisory checklist rather than a patch cycle — there is no single vulnerability here to close. The following restates conventional guidance for the threat class Kratos represents; none of it depends on the specifics of the kit.

First, review the strength of MFA in place. Where feasible, move high-value and administrative accounts toward phishing-resistant methods — for example FIDO2 security keys or passkeys — which are designed to resist the fake-login-page pattern that kits like this rely on. Second, treat the authenticated session as an asset worth protecting: shorten session lifetimes where practical, apply conditional-access policies that weigh device and location signals, and make sure administrators know how to revoke active sessions and sign a user out everywhere after a suspected phishing hit.

Third, tune monitoring toward session and token anomalies — sign-ins from unexpected locations, impossible-travel patterns, or new sessions that appear without a corresponding fresh authentication — rather than watching only for failed passwords. Fourth, keep user reporting frictionless: a takedown removes one platform's infrastructure, not the underlying technique, and fast internal reporting of a suspicious Microsoft login prompt remains one of the more reliable early signals. None of these are new in light of Kratos; the takedown is a timely occasion to confirm they are actually in place.

Open Questions

Several specifics are unresolved at publication, and The CyberSignal is not filling them in. The arrested individual's name has not been made public in the reporting reviewed; the platform's full customer count and total victim tally are estimates rather than confirmed figures; it is not established whether Kratos has been tied to specific named campaigns; and it is not confirmed whether US indictments tied to the operation have been unsealed.

What is clear is the shape of the action: a coordinated, cross-border takedown of the infrastructure behind a widely used phishing-as-a-service platform, paired with an arrest of its alleged operator. As official statements from the BKA, ZIT, and US authorities are published and independently reviewed, the numbers and the attribution will sharpen — and The CyberSignal will note any corrections against the estimates reported here.

The CyberSignal Analysis

The reported facts above come from the takedown announcements and their reporting; what follows is The CyberSignal's editorial reading. None of the judgments below are new reported facts.

Signal 01 — Infrastructure Falls Faster Than the Market

Seizing 200-plus servers and arresting an alleged operator is a genuine disruption, and our reading is that it should be counted as a real win — not discounted. But the honest framing for defenders is that a takedown removes a supplier, not the demand. Phishing-as-a-service exists because there is a paying customer base for turnkey Microsoft 365 credential theft, and that base does not disappear when one platform's hosting goes dark.

The practical implication is to treat the quiet that follows a takedown as temporary. Displaced customers migrate to the next kit, and the interval before they do is exactly the window in which to confirm defenses are current. Reading the Kratos action as "resolved" would misuse it; reading it as a countdown to the next platform uses it well.

Signal 02 — The Named Target Class Is the Advisory

What makes this takedown unusually actionable is that it comes with an addressee. Many enforcement announcements describe infrastructure in the abstract; this one names Microsoft 365 customers as the population the kit was built to hit. Our view is that defenders should read that naming as a low-noise sector advisory pointed directly at them.

The useful response is not to hunt for a Kratos-specific indicator, which for most organizations will not exist, but to act on the target class: confirm that phishing-resistant MFA, session-aware conditional access, and token-anomaly monitoring are in place for Microsoft 365. The value of the announcement is the prompt, and the prompt has a clear owner.

Signal 03 — An Arrest at the Top Is the Rarer Result

Most infrastructure takedowns end at the servers. What distinguishes this one, in the reporting reviewed, is the arrest of the person alleged to have built and run the platform — the operator, not merely a customer. Our assessment is that reaching the developer is the higher-value outcome, because it removes the maintenance and support that keep a service usable, not just the current hosting.

We would still temper expectations. An arrest is a charge, not a conviction; the individual is unnamed and the case is early; and a single operator's removal does not foreclose others rebuilding a comparable service. But as a signal about where enforcement is aiming — at the people who industrialize phishing, not only the boxes they rent — the Kratos action is a notable data point in a maturing pattern.

Sources