Theregister Global Takedown of Kratos Phishing-as-a-Service Infrastructure
Article Content
- •Kratos was a major phishing-as-a-service platform targeting Microsoft 365 users.
- •Over 200 servers were seized, disrupting 15,000 phishing campaigns per month.
- •The operation involved collaboration between German, U.S., and Indonesian law enforcement.
On July 20, 2026, German and U.S. authorities dismantled the Kratos phishing-as-a-service (PhaaS) platform, arresting its developer in Indonesia. The operation neutralized over 200 servers and disrupted approximately 15,000 phishing campaigns monthly, affecting hundreds of thousands of victims across more than 30 countries, primarily in Europe and the U.S. Kratos allowed low-skill cybercriminals to create convincing Microsoft-themed phishing pages, facilitating credential theft and further crimes. The platform generated over €300,000 since 2024, with around 1,800 criminal affiliates utilizing the service. The takedown marks a significant achievement in combating sophisticated phishing infrastructures.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (17)
Following this threat?
Track Microsoft in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing…