Kratos Phishing Kit Busted, Bypassed MFA for 1,800 Gangs

German police, working with the FBI and Indonesian authorities, dismantled Kratos, a subscription phishing kit that quietly became one of the most used criminal tools on the internet. Roughly 1,800 criminal groups rented it to run about 15,000 phishing campaigns a month, and its Microsoft themed login pages did not just steal passwords. They captured live session cookies, which let attackers walk past multifactor authentication entirely.

Key Takeaways

• Germany's Frankfurt prosecutor's office (ZIT) and Federal Criminal Police (BKA) led Operation Olympus Blade, seizing more than 200 servers behind the Kratos phishing kit on July 21, 2026, with the FBI now holding the seized domains.
• Roughly 1,800 criminal groups subscribed to Kratos and used it to run an estimated 15,000 phishing campaigns a month against victims in more than 30 countries.
• Kratos used a reverse proxy to relay victims' credentials and MFA prompts to the real Microsoft login page in real time, then captured the resulting session cookie, letting operators hijack an already authenticated session without ever needing the password again.
• Indonesian police arrested the alleged developer and technical administrator of Kratos, whom investigators say earned at least 300,000 euros ($342,000) in subscription fees since 2024.
• Kratos is the second major adversary-in-the-middle phishing kit taken down in 2026, after Europol dismantled Tycoon 2FA in March, a platform that had reached 500,000 organizations a month before its own takedown.

What Was Kratos?

Kratos was sold as a criminal service, not a piece of malware you install once. Subscribers rented access to a toolkit for building convincing Microsoft authentication pages, then aimed them at targets picked from their own lead lists. According to The Register's reporting on the takedown, German investigators called it one of the world's most widely used criminal phishing services, and the numbers back that up. Confirmed victims spanned manufacturing, retail, and healthcare organizations in the US, and industrial firms, law firms, polytechnics, schools, and small and midsize businesses across Europe.

That breadth is the point of a phishing-as-a-service model. A single developer builds and maintains the infrastructure once, then leases it to hundreds of separate criminal operations that would otherwise lack the skill to build a convincing Microsoft clone themselves. Authorities estimate the platform earned its operator at least 300,000 euros in subscription fees since 2024, a modest sum next to the hundreds of thousands of victims it touched across more than 30 countries.

How Did Kratos Bypass MFA?

Kratos bypassed MFA by sitting between the victim and Microsoft's real login page rather than faking the whole authentication flow on its own server. This technique is called adversary-in-the-middle, or AiTM, phishing. Instead of hosting a static fake page that only captures a typed password, an AiTM kit runs a reverse proxy: the victim's browser talks to the attacker's server, which forwards every request to the genuine login.microsoftonline.com and relays every response back.

The victim sees what looks like a real Microsoft sign in. They type their password, and Kratos passes it straight through. Microsoft prompts for MFA, and the victim completes it normally, an approval on their phone or a code from an authenticator app. Because the request is genuinely reaching Microsoft, the MFA challenge is real, but the proxy sitting in the middle can see the resulting session cookie the moment Microsoft issues it. Microsoft's own security research describes this pattern as attackers obtaining a token issued directly to their own infrastructure, which then unlocks mail, SharePoint, OneDrive, and Teams without any further login prompt.

This is why AiTM kits are considered more dangerous than older credential harvesters. A stolen password alone is useless against an account with MFA enabled. A stolen session cookie is not a password at all, it is proof the login already happened, and most systems trust that proof for hours or days.

How Was Kratos Taken Down?

Frankfurt's Central Office for Combating Internet Crime and the BKA led the investigation, working with US law enforcement and Indonesian police. The action, branded Operation Olympus Blade, neutralized more than 200 servers that formed Kratos's core infrastructure, and a seizure banner posted to the platform's former storefront now credits domain ownership to the FBI. Indonesian authorities separately arrested the person investigators describe as the kit's developer and technical administrator, cutting off the person who wrote and maintained the software rather than just one of its 1,800 customers.

Arresting a developer, not a renter, is the detail worth noticing. Taking down servers slows a platform down. Removing the person who builds and patches the underlying reverse proxy code makes it far harder for the service to simply relaunch under a new name with the same customer base intact.

Looking Ahead

Most coverage of a takedown like this reads as a clean win, and operationally it is. But the more useful comparison is what happened after Europol's March 2026 disruption of Tycoon 2FA, a rival AiTM kit that had reached 500,000 organizations a month before it was hit. CrowdStrike's research team found that Tycoon 2FA activity continued afterward, because the takedown disrupted infrastructure without eliminating the code, the customer base, or the market demand that built it in the first place.

Kratos's 1,800 subscribers did not stop wanting a way to bypass MFA the day their toolkit went dark. Some fraction of them will simply move to Tycoon 2FA's successors, to newer kits this same industry has been tracking through 2026, or to whatever fills the gap Kratos leaves behind. Two major AiTM phishing platforms falling in a single year is a sign law enforcement is getting faster at this, not a sign the underlying technique is going away.

Why Email Users Should Care

Every Kratos campaign, and every AiTM attack like it, starts with an email. The convincing Microsoft branded login page is the payload, but the delivery mechanism is a message in someone's inbox: a fake invoice notification, a shared document link, an account security warning, anything that gives the victim a reason to click through to what looks like a normal Microsoft sign in. If that first email never lands, the reverse proxy behind it never gets a chance to run.

This is a different threat model from what Gblock addresses. Gblock blocks the invisible tracking pixels that marketers and senders embed in ordinary email to log when you open a message, not phishing pages delivered through malicious links. Worth being precise about that distinction, since conflating the two undersells what an AiTM attack actually requires from a victim: they still have to click a link and type real credentials into a fake page. That means the standard advice remains the strongest defense available to any individual reader: verify the sender before clicking, check that a login page's domain is genuinely microsoft.com or microsoftonline.com before typing a password anywhere, and treat unexpected "verify your account" emails with the same suspicion regardless of how polished they look.

For a closer look at how similar kits reach an inbox in the first place, Gblock has covered how phishing kits like Kali365 use device code flows to grab OAuth tokens without ever touching a password, and how law enforcement previously shut down the W3LL phishing kit and arrested its creator after it drained $20 million from victims.

What Should You Do to Defend Against AiTM Phishing?

Password based MFA, including SMS codes, authenticator app codes, and push approvals, does not stop an AiTM reverse proxy, because the victim completes the real challenge and the attacker simply captures what comes out the other end. CISA's guidance on phishing resistant MFA is explicit that only FIDO2 and WebAuthn based methods, security keys, passkeys, and platform authenticators that cryptographically bind a login to the real domain, actually stop this class of attack. A few concrete steps follow from that:

• Move high value accounts to hardware security keys or passkeys rather than SMS or app based push MFA, since those methods verify the domain and cannot be relayed through a proxy.
• Enable conditional access policies that flag or block logins from unfamiliar IP ranges or impossible travel patterns immediately after a successful MFA challenge, since that is exactly when a stolen session cookie gets used.
• Shorten session token lifetimes for sensitive applications so a captured cookie has a smaller window of usefulness.
• Train employees to check the address bar, not just the page design, since AiTM kits mirror Microsoft's real interface almost pixel for pixel.
• Monitor for known phishing kit infrastructure patterns, since AiTM proxies often reveal themselves through TLS certificate anomalies or unusual redirect chains even when the visible page looks legitimate.

Kratos is gone, but the reverse proxy technique it industrialized is not going anywhere. Organizations that treat this takedown as reason to defer the move to phishing resistant MFA will simply meet the next version of Kratos with the same gap it exploited the first time.