Authorities Shut Down Phishing Empire Launching 15,000 Attacks Every Month

Authorities dismantled Kratos, a major phishing-as-a-service operation behind around 15,000 monthly phishing campaigns, shutting down a global infrastructure used for large-scale credential theft.

The operation involved collaboration between German law enforcement agencies and authorities in the United States and Indonesia. Indonesian authorities arrested the alleged developer and technical administrator of the Kratos infrastructure.

Investigators also neutralized more than 200 servers connected to this service, identifying around 850 victims across 35 countries, primarily in Europe and the United States.

The actual number of targeted users may be significantly higher, as individual phishing campaigns can reach thousands of recipients.

Kratos Phishing Service Disabled

Kratos operated as a “digital construction kit” for cybercrime, providing an easy-to-use toolkit that allowed subscribers to create and manage phishing pages designed to mimic Microsoft authentication portals closely.

Victims who unwittingly entered their email addresses, passwords, or other personal information into these fake login forms unknowingly handed their credentials over to attackers.

Stolen Microsoft account credentials can lead to various follow-up attacks, including business email compromise, unauthorized cloud access, account takeover, internal phishing, financial fraud, and data theft.

Microsoft-themed lures are particularly effective, as businesses, public sector organizations, and consumers alike widely use services like Microsoft 365.

The Kratos platform was reportedly leased to other criminals under a phishing-as-a-service model, lowering the technical barriers for aspiring attackers. This allowed individuals without the skills to develop phishing infrastructure to run professional-looking campaigns.

Authorities estimate that more than 1,800 criminal customers purchased access to Kratos, which allegedly generated over €300,000 in revenue since 2024, supporting around 15,000 phishing campaigns each month.

The recent takedown targeted the central technical components of the Kratos ecosystem, not just individual phishing websites.

By eliminating the service’s server infrastructure and arresting its technical administrator, investigators have achieved a complete shutdown of Kratos-supported campaigns.

BKA states that phishing has become increasingly industrialized, with criminals renting ready-made platforms that provide templates, hosting, and support to run scalable campaigns.

Organizations should continue to regard Microsoft login prompts, password reset messages, and shared document notifications as high-risk phishing themes.

Defenders can reduce their exposure by enforcing phishing-resistant multi-factor authentication, monitoring suspicious sign-in activity, blocking newly registered or lookalike domains, and training users to verify login URLs before entering their credentials.

The BKA has described this operation as a significant success against one of the world’s most dangerous phishing-as-a-service groups. With the Kratos infrastructure disabled, its former customers can no longer use the platform to conduct campaigns, thereby preventing further credential theft and potential downstream fraud.

The Privilege Paths Attackers See That You Don’t: BeyondTrust Pathfinder Platform Does It for You -> Get Free Identity Security Assessment