Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA
Summary: German and US law enforcement took down the core infrastructure of the Kratos phishing kit, pulling more than 200 servers offline, and Indonesian authorities arrested the man they say developed and ran it. The BKA said roughly 1,800 paying customers ran about 15,000 phishing campaigns a month with the kit, which stole session cookies alongside logins to bypass two-factor authentication, with victims since late 2024 numbering in the hundreds of thousands across more than 30 countries.
Why it matters: The takedown left the roughly 1,800 customers and the kit code they already hold untouched, and ANY.RUN found Kratos running on disposable domains and compromised WordPress sites - the kind of setup that reappears under a new name once servers go down. For anyone Microsoft is notifying, a stolen session cookie survives a password reset and has to be revoked separately.
Read the original at The Hacker News ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026