- \n
- Kratos is a turnkey phishing kit<\/strong> built to steal Microsoft 365 credentials and sold through a subscription model. Operator-side intelligence, including its admin panel and automated deployment features, shows that it operates as a full Phishing-as-a-Service (PhaaS) platform.<\/li>\n\n\n\n
- ANY.RUN researchers identified 1,628 <\/strong>sandbox sessions<\/strong><\/a> across the two main Kratos generations.<\/strong> Only 156 had been manually tagged as Kratos, while 1,484 had not yet been attributed to the family. An earlier V0 branch adds another nine sessions. <\/li>\n\n\n\n
- Kratos targets organizations across more than 20 countries, including the US.<\/strong> This research identified 148 suspected victim organizations, with a particularly strong concentration in US, Spain and Southern Europe.<\/li>\n\n\n\n
- ANY.RUN was already detecting the malicious activity through generic phishing-kit signatures.<\/strong> The new technical fingerprint added family-level attribution, making it possible to track Kratos activity, run retrospective hunts, and build a clearer view of the wider operation. <\/li>\n\n\n\n
- Two page assets became the key hunting indicator:<\/strong> barr.svg and lg.svg. They almost always appear together and are rarely seen separately. This single fingerprint provides 90% recall with a false-positive rate close to zero.<\/li>\n\n\n\n
- Kratos has evolved through three page generations:<\/strong> V0, V1, and V2. Each uses different exfiltration code, and the kit continues to develop.<\/li>\n\n\n\n
- Kratos has been visible in the ANY.RUN sandbox since January 2026.<\/strong> External data suggests that its operator panel has been active since September 2025.<\/li>\n\n\n\n
- Operator-side OSINT uncovered an active Kratos admin panel.<\/strong> The service allows operators to deploy phishing domains in a few clicks, configure Telegram or email delivery, apply geographic restrictions, and choose between several anti-bot systems.<\/li>\n<\/ul>\n\n\n\n
Victimology: Kratos Targeting US and European Organizations <\/h2>\n\n\n\n
Microsoft 365 is the main brand impersonated by Kratos. In total, 1,365 sandbox tasks led to login.live.com or microsoftonline.com, while 412 were classified as \u201cFake Microsoft Authentication Page\u201d<\/strong>incidents.<\/p>\n\n\n\n
Previous public research has documented Kratos activity across more than 20 countries, with around 33% of observed targeting linked to the United States. This confirms that the service has a broadinternational reach and poses a direct risk to US organizations. <\/p>\n\n\n\n
- ANY.RUN researchers identified 1,628 <\/strong>sandbox sessions<\/strong><\/a> across the two main Kratos generations.<\/strong> Only 156 had been manually tagged as Kratos, while 1,484 had not yet been attributed to the family. An earlier V0 branch adds another nine sessions. <\/li>\n\n\n\n
![\"\"](\"https:\/\/any.run\/cybersecurity-blog\/wp-content\/uploads\/2026\/07\/Screenshot-2026-07-14-at-09.44.26-1024x494.png\")