The Register - Security • 2h
Dismantling the Kratos Phishing-as-a-Service Infrastructure Targeting Microsoft
A multinational law enforcement operation led by Germany's BKA and ZIT, in coordination with the US and Indonesia, has neutralized the Kratos (aka SneakyLog/Sneaky 2FA) Phishing-as-a-Service (PhaaS) infrastructure. The operation resulted in the seizure of over 200 servers and the arrest of a primary administrator in Indonesia. Kratos leveraged Adversary-in-the-Middle (AiTM) proxying to intercept Microsoft 365 authentication flows, enabling the theft of session tokens to bypass multi-factor authentication (MFA). While the backend infrastructure is offline, approximately 1,800 active affiliates retain access to target lists and may migrate to alternative PhaaS kits, maintaining the operational threat level.