Overview
- Investigators say they took more than 200 servers offline and the developer and technical administrator was arrested in Indonesia, actions that authorities say disabled the service.
- Kratos was a commercial 'phishing-as-a-service' toolkit that let users build fake sign‑in pages, especially copies of Microsoft authentication screens, to harvest passwords and email addresses.
- The service also copied session cookies to bypass two‑factor authentication, which increased the risk of account takeover and broader network infiltration.
- Officials say roughly 1,800 criminal customers used Kratos to run about 15,000 phishing campaigns per month since late 2024, producing several hundred thousand victims and about €300,000 in revenue.
- German prosecutors have opened investigations on charges including running a commercial criminal platform and preparing computer fraud, and companies such as Microsoft will be notified so affected users can be warned.