Kratos

The Kratos PhaaS: How Turnkey Phishing Scales Microsoft 365 Account Takeovers

Key Takeaways

• Kratos is a sophisticated Phishing-as-a-Service (PhaaS) platform specifically engineered to industrialize the theft of Microsoft 365 credentials and bypass multi-factor authentication (MFA).
• The platform shares hosting infrastructure with other AiTM phishing kits, including Tycoon, Flowerstorm, Sneaky2FA, and EvilProxy.
• In July 2026, a major international law enforcement action known as Operation Olympus Blade disrupted the service, leading to the shutdown of over 200 servers and the arrest of the lead developer in Indonesia.
• Despite its disruption, the kit was highly scalable, supporting over 1,800 criminal subscribers who launched an estimated 15,000 phishing campaigns per month.
• Kratos utilizes a decoupled architecture, ensuring that harvested data is exfiltrated in real-time to Telegram bots, which allows stolen information to remain accessible even if the phishing URLs are taken down.
• ANY.RUN researchers identified unique technical fingerprints, specifically the presence of barr.svg and lg.svg assets, which provide near-100% accuracy in attributing malicious activity to the Kratos family.

Kratos phishing attack exposed in ANY.RUN's Interactive Sandbox

What is Kratos?

Kratos is a subscription-based cybercrime service that provides a "turnkey" solution for threat actors looking to compromise Microsoft 365 environments at scale. As a Phishing-as-a-Service (PhaaS) model, it lowers the barrier to entry for low-skilled attackers by offering a centralized administrative dashboard that automates the deployment of phishing domains, VPS infrastructure, and anti-bot protections.

Evolution of Kratos phishing

The kit represents a significant technical evolution from its predecessor, Sneaky2FA. While earlier versions functioned as traditional info-stealers, the modern Kratos platform utilizes adversary-in-the-middle (AiTM) techniques to relay live authentication sessions between victims and legitimate Microsoft login servers. This allows the kit to capture not only passwords but also the session tokens required to bypass MFA challenges.

The "business" of Kratos is highly organized, operating through Telegram-based subscriptions where affiliates pay for access to ready-made phishing templates, such as those mimicking Adobe Creative Cloud or DocuSign. The platform's internal logic includes advanced features such as:

• Automated Vetting: Using services like geoplugin[.]net to geolocate victims and filter out non-target regions or security researchers.
• Anti-Analysis Defenses: Integrated support for Cloudflare Turnstile, reCAPTCHA, and hCaptcha to prevent automated scanners from detecting the phishing pages.
• Multi-Generational Development: ANY.RUN has tracked the kit through three distinct generations (V0, V1, and V2), showing a steady progression toward more convincing brand impersonation and more heavily obfuscated code to evade security vendor signatures.

By utilizing an encrypted exfiltration chain via the Telegram Bot API, Kratos ensures that its criminal operators can receive stolen credentials instantly and securely, blending their malicious traffic with legitimate web service activity.

How Kratos Threatens Businesses and Organizations

Kratos represents a significant escalation in the threat landscape because it moves beyond simple password harvesting toward total account takeover (ATO) and long-term persistence within corporate environments.

By industrializing the theft of Microsoft 365 credentials, the platform creates several critical risks for modern enterprises:

• Advanced Business Email Compromise (BEC): Once an account is compromised, attackers can monitor executive communications, intercept ongoing financial conversations, and alter payment instructions. Because these fraudulent requests originate from a legitimate, trusted mailbox, they are extremely difficult for both automated filters and employees to detect.
• Bypassing Multi-Factor Authentication (MFA): Unlike traditional phishing kits that only steal passwords, Kratos employs Adversary-in-the-Middle (AiTM) techniques. By relaying live authentication sessions between the victim and Microsoft's real servers, the kit captures active session tokens. This allows attackers to bypass MFA challenges entirely, as the token confirms to Microsoft that the "user" has already authenticated.
• Persistent Infrastructure Access: A major danger of Kratos is its ability to maintain access even after a security incident is identified. If an attacker gains session access through a stolen token, a simple password reset may not be enough to remove them. Unless security teams explicitly revoke active sessions and refresh tokens, the threat actor can remain inside the environment indefinitely.
• Data and Partner Exposure: Compromised accounts provide a gateway to sensitive business data stored in SharePoint, Teams, and OneDrive. This exposure often extends to third-party partners and suppliers, as attackers can use the compromised account to harvest contact lists and launch secondary attacks against the organization’s entire supply chain.

Victimology: Who Is Most Vulnerable?

The Kratos platform is a global threat that has successfully targeted victims in over 30 countries. While its reach is international, analysis of ANY.RUN Interactive Sandbox data and industry reports reveals specific geographic and sectoral concentrations:

• Primary Focus on the United States: The U.S. remains the most targeted region, accounting for approximately 33% of all observed Kratos activity.
• Strong Concentration in Southern Europe: Researchers have identified a heavy focus on Spain and other Southern European nations. This is evidenced by the use of Spanish-language "tokens" in the phishing URLs, such as abogados (lawyers), factura (invoice), and dgt (Spain’s traffic authority).
• Sector-Agnostic Targeting: While the platform hits a wide range of industries, the targeting is largely opportunistic. Vulnerable sectors include legal and financial services, education and healthcare, industrial and SMBs.

Ultimately, any organization that relies on Microsoft 365 for its daily operations is within the scope of Kratos. The kit does not exploit a software vulnerability but rather exploits the human element and the ubiquitous nature of Microsoft’s authentication workflows.

How Does Kratos Malware Function? (The Sandbox Analysis)

Detonating a Kratos sample in the ANY.RUN Interactive Sandbox provides a clear, step-by-step view of how the PhaaS platform operates. By moving beyond static analysis, defenders can observe the following stages of the attack in real-time:

Stage 1: The Intermediary Lure and "Buffer" Pages

The Kratos infection chain begins with a targeted phishing email that is frequently successful in bypassing corporate email filters and secure email gateways.

Kratos phishing email

To further evade detection by automated scanners, the attack does not link directly to the final phishing landing page. Instead, the email directs the victim to an intermediary "buffer" site hosted on a legitimate, trusted platform. In the ANY.RUN Sandbox, analysts frequently observe redirects through services such as Microsoft SharePoint, OneDrive, Canva, Tilda, or Microsoft Forms.

Stage 2: Passing the "Challengepoint"

Before the phishing form is even loaded, Kratos initiates a verification gate to filter out automated security crawlers. The victim is presented with a Cloudflare Turnstile or CAPTCHA. In the network logs, this is often identified as "challengepoint". This step ensures that the sandbox is being operated by a human, making it harder for headless security scanners to reach the payload.

Stage 3: Visual Social Engineering Hallmarks

Loading page used in Kratos attacks

Once verified, the kit presents its unique visual identity. A distinctive feature of Kratos is the animated envelope screen. The victim sees an animation with the message “Loading in progress…” overlaid on a blurred image of an invoice or document. The browser tab title typically changes to “Authentication” during this phase. This high-fidelity branding is designed to build trust immediately before requesting credentials.

Stage 4: Real-Time Data Harvesting and Exfiltration

Kratos phishing attack exposed in ANY.RUN's Interactive Sandbox

The most critical part of the analysis occurs during the login attempt. Using ANY.RUN’s In-browser data inspection, analysts can deobfuscate the script behavior:

• The Functionality: Analysts can see the submitData() function capturing the user's input (marked as di and pr parameters).
• The Endpoints: Depending on the generation, the data is sent via a POST request to specific PHP endpoints: /next.php (V1), /save.php (V2), or /mini.php (V0).
• AiTM Indicators: The sandbox may also record WebSocket activity, which is a strong behavioral signal of Adversary-in-the-Middle (AiTM) behavior, where the kit relays session data in real-time to bypass MFA.

Stage 5: Telegram Bot Communication

Kratos uses a decoupled architecture, meaning the exfiltration happens server-side, but its traces are visible in the sandbox's network traffic:

• The Dropzone: The kit communicates with the Telegram Bot API to send stolen data to the attacker’s private channel.

• Data Packaging: Credentials, IP addresses, geolocations, and device types are bundled into JSON logs, ensuring the attacker receives the data even if the phishing site is taken down immediately.

Stage 6: The Exit and Redirection

To avoid suspicion, the kit limits login attempts. In the sandbox, analysts can observe that after three failed attempts, the victim is automatically redirected to a legitimate URL. This final step is intended to make the victim believe they simply had a minor login error, delaying any potential report to their IT security team.

How Businesses Can Use ANY.RUN’s Threat Intelligence Against Kratos

ANY.RUN’s Threat Intelligence serves as a powerful proactive defense solution, allowing SOC teams to move beyond a single indicator and view the entire Kratos ecosystem through a continuously updated threat database that is based on sandbox submissions by 15K organizations and 600K security analysts.

ANY.RUN's Lookup offers latest intel on Kratos and other phishing

Threat Intelligence Lookup allows for precise family-level identification. By using the query threatName:"kratos", analysts can instantly access a consolidated view of all data related to Kratos attacks globally. This helps teams understand the current scale of the threat and determine if their specific industry or region is currently being targeted by active clusters.

One of the most effective ways to use TI Lookup against Kratos is by searching for static asset hashes. Even when attackers change their domain names or rename files, the underlying content of the kit remains largely the same.

Cross-Campaign Linking: Analysts can query for the specific SHA256 hash of the styles.css file, which has been found to connect over 630 sandbox analyses across both the V1 and V2 generations of the kit.

Asset Fingerprinting: Searching for the unique hashes of files like lg.svg (V1) or dsa.svg (V2) allows teams to identify Kratos landing pages with near-100% accuracy, even on compromised legitimate websites where the file path might be hidden.

Check this TI Lookup query based on the lg.svg and styles.css hashes:

SHA256:”c447e75f1029ed7a5882add16bcd13ad44be3bd47c93c830ff39185e23d25ebb” AND SHA256:”cd231b895bbcd7154b81df1e065bf02f1ec667b920c8b6d23308cd509833b5ea”

By integrating TI Lookup queries into their regular hunting workflows, SOC and MSSP teams can significantly reduce business exposure to Kratos and contain account compromise attempts before they escalate into full-scale data breaches.

ANY.RUN's TI Feeds offer a real-time stream of phishing IOCs

For organizations looking to automate their defense, ANY.RUN’s Threat Intelligence Feeds provide a continuous stream of the most recent network indicators (IPs, domains, and URLs) associated with active phishing campaigns. The TI Feeds are updated in real time based on the latest threat submissions to ANY.RUN’s Sandbox from 15K organizations and 600K analysts.

By integrating these feeds into SIEMs and security controls, teams can automatically block emerging phishing infrastructure and detect malicious activity before attackers establish persistence or hijack session tokens.

Conclusion

While Operation Olympus Blade successfully dismantled the central Kratos infrastructure in July 2026, the broader Phishing-as-a-Service (PhaaS) ecosystem is only gaining momentum. Industry projections estimate that over 90% of all credential compromise attacks will be enabled by modular PhaaS kits by the end of 2026.

The rapid emergence of alternative platforms, such as Kali365, demonstrates that as one service is taken offline, others quickly fill the void to target Microsoft 365 environments. For organizations, the focus must shift from reacting to individual takedowns to maintaining proactive visibility through threat intelligence and adopting defense-in-depth strategies, such as revoking active session tokens rather than relying solely on password resets.

Frequently Asked Questions: Kratos PhaaS

1. What is Kratos PhaaS?

Kratos is a turnkey Phishing-as-a-Service platform used to steal Microsoft 365 credentials. It is a direct evolution of the Sneaky2FA kit.

2. How does it bypass MFA?

It employs Adversary-in-the-Middle (AiTM) techniques to proxy live login sessions and capture session tokens, allowing attackers to bypass multi-factor authentication entirely.

3. What are the key indicators of a Kratos attack?

Visually, victims see a “Loading in progress…” animation over a blurred document. Technically, the kit is identified by assets like barr.svg and lg.svg (V1) or dsa.svg and sid.gif (V2).

4. How is stolen data exfiltrated?

Stolen credentials and metadata are packaged as JSON and sent in real-time to Telegram bots, ensuring data remains accessible even if the phishing site is taken down.

5. Was the Kratos infrastructure shut down?

Yes. In July 2026, Operation Olympus Blade dismantled the service, shutting down over 200 servers and resulting in the lead developer's arrest in Indonesia.

6. Who are the primary targets?

The platform has a global reach (30+ countries), focusing heavily on the United States (33%) and Southern Europe, particularly Spain.