Kratos was a phishing-as-a-service platform that provided cybercriminals with tools to create and manage fake Microsoft authentication pages to steal email addresses and passwords. It was used globally, with confirmed victims in 35 countries and particularly active in Europe and the United States. The platform facilitated roughly 15,000 phishing campaigns per month by over 1,800 criminal customers. The stolen credentials were often used for further crimes such as business email compromise and account takeover. Law enforcement agencies in Germany and the U.S. dismantled the infrastructure by seizing over 200 servers and arrested the developer in Indonesia, rendering the service inoperable and transferring domain ownership to the FBI for further investigation.

The Kratos platform enabled large-scale credential theft targeting Microsoft accounts worldwide, potentially leading to account hijacking, business email compromise, data theft, and subsequent phishing attacks on victims' contacts. The disruption of the platform stops ongoing phishing campaigns and prevents further credential theft via this service. The seizure also provides law enforcement with forensic evidence to identify and prosecute customers of the service, potentially reducing future phishing threats linked to Kratos.

The Kratos phishing platform has been dismantled and its infrastructure seized by law enforcement, rendering it inoperable. The arrest of the developer and domain seizure mean that no further phishing campaigns using this service can currently continue. Organizations should remain vigilant for phishing attempts from other sources and monitor for compromised credentials, but no specific remediation for Kratos is currently required due to the takedown.