Kratos Phishing Kit Dismantled in Global Takedown

German and US law enforcement, joined by Indonesia’s Polri, dismantled the core infrastructure of Kratos on Monday and arrested the Indonesian national they say developed and ran it. Frankfurt’s ZIT and Germany’s Federal Criminal Police Office (BKA) described Kratos as one of the world’s most widely used criminal phishing kits in a joint announcement released July 22, 2026.

Kratos wasn’t commodity credential-harvesting software. It was built specifically to defeat multi-factor authentication on Microsoft 365 accounts.

What Kratos did

Kratos operated as an adversary-in-the-middle (AiTM) proxy. Victims clicked a link, saw a convincing Microsoft 365 login flow, and completed authentication — including whatever second factor they had enrolled. What they were actually doing was handing their credentials and their post-authentication session token to Kratos’s operator infrastructure. The kit relayed the session cookie back to the attacker’s tooling, giving them an authenticated session without the password and without touching the second factor at all.

That’s the design point. TOTP codes, push notifications, SMS OTPs — these protect the password flow, not the session that comes after it. AiTM proxy attacks don’t steal passwords so much as they steal the proof that you already authenticated. The second factor becomes irrelevant once the session exists.

What to actually do

The infrastructure is down. The developer is in custody. That ends Kratos specifically. It doesn’t end AiTM phishing — Evilginx, Modlishka, and several commercial successor kits cover the same ground, and takedowns of this type historically produce forks before they produce meaningful technique reduction.

For Microsoft 365 environments:

Audit recent sign-in logs. Look in Entra ID for sessions with unfamiliar IP addresses or locations that appeared immediately after a successful interactive authentication event. The risky sign-ins panel in Entra ID P2 surfaces some of this automatically; if you’re on a lower SKU, export sign-in logs and query for session activity originating from IPs that don’t match your known user base or VPN egress.

Review conditional access for legacy authentication. AiTM proxying is most effective when legacy auth protocols (SMTP AUTH, IMAP, Basic auth) are in play. If conditional access policies have gaps that allow legacy auth flows, close them. Legacy auth bypasses modern MFA enrollment entirely.

Enforce phishing-resistant MFA where you can. FIDO2/WebAuthn hardware keys and certificate-based authentication resist AiTM at the protocol level — the authentication is cryptographically bound to the origin URL, so a proxy presenting a fake origin breaks the handshake before a credential is issued. Push notifications and TOTP are not phishing-resistant by this definition. The distinction matters.

Check your mail gateway logs. If Kratos was active in your sector, you may have phishing attempts in your log history you haven’t correlated yet. Search for messages spoofing Microsoft sign-in pages, Conditional Access notices, or shared-document lures — the standard pretexts for M365 credential campaigns.

Priority call

If your organization is a plausible target for M365 credential theft — financial services, legal, healthcare, anything that stores sensitive data in SharePoint or Exchange — phishing-resistant MFA is worth a project ticket this week. Fido2 key rollout takes planning, but the conditional access policy change to require it for privileged accounts can happen faster. Start there.

If you’re already on hardware keys or certificate-based auth for admin accounts: the Kratos takedown changes nothing for you. You were already outside this attack’s reach.

For context on the credential ecosystem: Chick-fil-A disclosed a June credential-stuffing run last week — a different attack class (password reuse rather than session hijack), but the same downstream target: authenticated sessions and account access. The feed of stolen credentials that powers credential-stuffing runs and AiTM lure lists comes from the same markets. Cleaning up compromised credentials from old breach exposures limits exposure on both fronts.

Sources

• The Hacker News, 2026-07-22: Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA — covers the joint ZIT/BKA/US announcement and Indonesian arrest.