German authorities dismantle Kratos phishing-as-a-service infrastructure | brief

According to The Register, German authorities, with support from the US and Indonesia, have successfully dismantled the primary infrastructure behind the Kratos phishing-as-a-service (PhaaS) kit, a tool described as one of the most dangerous and widespread on the market.

The Kratos kit enabled cybercriminals with limited technical skills to harvest credentials, including passwords and session cookies, by providing convincing Microsoft-themed phishing pages. This allowed them to bypass multi-factor authentication. Authorities arrested the alleged developer and technical administrator in Indonesia. The operation neutralized over 200 servers, impacting an estimated 1,800 criminal enterprises that used Kratos for approximately 15,000 phishing campaigns monthly.

These campaigns targeted hundreds of thousands of victims in over 30 countries, with the operation earning more than €300,000 since 2024. Targets primarily included entities in the US and Europe, with key industries such as manufacturing, retail, healthcare, and educational institutions being affected. This takedown is seen as a significant step in combating sophisticated phishing infrastructures.