German and US police pull the plug on Kratos, a phishing kit rented to 1,800 crooks

Key points

• German and US law enforcement dismantled the Kratos phishing service and seized more than 200 servers in a joint operation announced this week.
• The developer of Kratos was arrested in Indonesia, and the service's website now carries an FBI seizure notice under the banner Operation Olympus Blade.
• Germany's Federal Criminal Police (BKA) says around 1,800 paying customers used Kratos to run about 15,000 phishing campaigns per month across 35 countries.
• The owner is estimated to have earned at least 300,000 euros (about 342,000 US dollars) in subscription fees since 2024.
• Kratos specialised in fake Microsoft login pages designed to steal email addresses and passwords.

Police in Germany and the United States have shut down one of the busiest phishing services on the internet, a rental kit called Kratos. We've covered this corner of the market closely: our June report on the Outsider Enterprise takedown counted nine thousand phishing sites and nearly four million stolen cards in a single bust.

Phishing is when criminals send fake emails or build fake login pages to trick people into handing over real passwords. Kratos was a ready-made toolkit for doing exactly that, sold by subscription to other criminals. It's the same rental model used by legitimate cloud apps, pointed at your inbox.

The Frankfurt Prosecutor General's Office (ZIT) and Germany's Federal Criminal Police (BKA) led the takedown, working with US agencies. Investigators pulled more than 200 servers offline and arrested the man they say built the platform. He was picked up in Indonesia. Visit the Kratos website now and you get an FBI seizure notice instead of a login screen.

What did Kratos actually do?

It sold convincing fake Microsoft sign-in pages to criminals who didn't want to build their own. A subscriber would send a target a link, often buried inside an email that looked like a routine Microsoft 365 notification. The victim clicked, saw what looked like a normal Microsoft login box, typed in their credentials. Those went straight to the attacker.

Once inside a Microsoft account, criminals typically read email, hunt for invoices to redirect, reset passwords on linked services, or send more phishing lures from the trusted account to the victim's colleagues and customers. The industry calls this business email compromise: stealing money by impersonating someone the target already works with.

BKA describes Kratos as "one of the world's most widely used criminal phishing services." Confirmed victims sit across 35 countries, concentrated in Europe and the United States. Each campaign, police say, could reach several thousand people.

What should ordinary people do now?

If you use a work or school Microsoft account, check two things.

First, turn on multi-factor authentication if you haven't already. That's the extra code from an app or a text message most workplaces now require. It would've stopped many Kratos victims from losing their accounts even after typing a password into a fake page.

Second, be suspicious of any Microsoft login page you reach by clicking a link in an email. Type the address yourself, or use a saved bookmark. Password managers help here too: they refuse to fill in credentials on a lookalike domain, because they catch the wrong web address even when your eyes don't.

Should you expect arrests to follow?

With the servers in police hands, investigators say they'll comb through seized machines for records of who bought subscriptions. The 1,800 customers may not stay anonymous long.

Kratos itself is finished. The business model isn't. Our July story on Forg365 showed a fresh Microsoft 365 phishing kit appearing within weeks of earlier busts, complete with AI-written lures and session-theft tricks. Another kit will fill the gap. It always does.