Kratos is a mature phishing-as-a-service platform that facilitates credential theft from Microsoft 365 users by deploying convincing phishing pages with anti-bot verification. The operation supports multiple phishing domain deployments, configurable delivery via Telegram or email, and geographic targeting. Researchers identified three generations of the phishing kit (V0, V1, V2) with distinct exfiltration methods and traced 1,484 unique phishing events. The campaign has been active since January 2026, with the operator panel active since September 2025, targeting organizations across more than 20 countries, with a concentration in the US, Spain, and Southern Europe.

Successful exploitation results in credential theft leading to Microsoft 365 account takeover, which can enable unauthorized access to sensitive organizational data and services. The phishing platform's sophistication, including anti-bot measures and geographic targeting, increases the likelihood of successful credential compromise in targeted regions.

No official patch or fix applies as this is a phishing campaign rather than a software vulnerability. Organizations should implement phishing awareness training, enforce multi-factor authentication (MFA) on Microsoft 365 accounts, and monitor for suspicious login activity. Since the threat targets Microsoft 365 credentials, enabling conditional access policies and using Microsoft Defender for Office 365 anti-phishing features are recommended. There is no vendor advisory indicating that no action is required or that the threat is already mitigated.