International law enforcement (BKA, FBI, ZIT) has successfully neutralized the Kratos Phishing-as-a-Service (PhaaS) platform by seizing over 200 malicious servers and arresting the primary developer in Indonesia. The Kratos infrastructure specialized in Adversary-in-the-Middle (AiTM) attacks, utilizing sophisticated proxy modules to bypass Multi-Factor Authentication (MFA) via session token and cookie harvesting. Targeting Microsoft 365 enterprise environments, the platform used specialized kits such as "SneakyLog" and "Sneaky 2FA" to facilitate Business Email Compromise (BEC). While the centralized backend is disrupted, the high volume of documented affiliates (approximately 1,800) presents a significant risk of rapid rebranding and tool replication.

• Incident Overview & Operational Disruption

  • Coordinated international law enforcement action involving German (BKA, ZIT) and US (FBI) agencies.
  • Seizure and takedown of 200+ active malicious servers associated with the Kratos backend.
  • Arrest of the primary developer and technical administrator located in Indonesia.
  • Disruption of the centralized command-and-control (C2) management infrastructure.

• Attack Vector & Technical Mechanics

  • Deployment of Adversary-in-the-Middle (AiTM) proxy infrastructure to intercept authentication traffic.
  • Use of high-fidelity Microsoft 365 themed phishing templates for credential and session theft.
  • Implementation of "SneakyLog" and "Sneaky 2FA" modules for automated session token and cookie harvesting.
  • Advanced bypass of Multi-Factor Authentication (MFA) through real-time session hijacking.

• Threat Scale & Impact Analysis

  • Industrialized PhaaS model supporting approximately 1,800 documented customer affiliates.
  • High-density targeting of enterprise-level Microsoft 365 environments.
  • Strategic focus on facilitating Business Email Compromise (BEC) via hijacked cloud sessions.
  • High intelligence value of seized affiliate datasets and customer lists.

• Strategic Implications & Industry Outlook

  • The "Hydra Effect": Decoupling of the Kratos vendor from independent, decentralized affiliates.
  • Ongoing risk of "whack-a-mole" due to the ease of cloning and reselling PhaaS intellectual property.
  • Discrepancy between law enforcement's "neutralization" claims and industry's "rebranding" predictions.
  • Shift from simple credential harvesting to sophisticated, automated session-based attacks.