Kratos is a mature phishing-as-a-service platform facilitating credential theft from Microsoft 365 users. It operates by deploying phishing domains with sophisticated anti-bot measures and convincing login pages to harvest credentials. The service includes an operator panel that allows attackers to manage phishing campaigns, configure delivery via Telegram or email, and restrict targets geographically. Researchers identified three generations of the phishing kit (V0, V1, V2) with distinct exfiltration code and traced 1,484 unique phishing events. The campaign has been active since January 2026, with the operator panel active since September 2025. The operation targets organizations in over 20 countries, with a concentration in the US, Spain, and Southern Europe.

Successful exploitation results in theft of Microsoft 365 credentials, enabling attackers to perform account takeover. This can lead to unauthorized access to sensitive organizational data, potential lateral movement, and further compromise within targeted environments. The campaign's use of anti-bot verification and trusted platform mimicry increases the likelihood of successful credential harvesting.

No official patch or fix applies as this is a phishing campaign rather than a software vulnerability. Organizations should implement multi-factor authentication (MFA) for Microsoft 365 accounts to reduce the risk of account takeover. User awareness training to recognize phishing attempts and the use of email filtering solutions to detect and block phishing emails are recommended. Monitoring for suspicious login activity and promptly responding to credential compromise can further mitigate impact.