Police shut down Kratos, the phishing kit built to hijack Microsoft 365 logins

Key points

• German and US law enforcement seized the core servers of Kratos, a phishing kit that German investigators call one of the most widely used criminal tools of its kind, in an operation announced on Monday.
• Indonesian authorities arrested the man they say built and ran the service.
• Kratos stole live Microsoft 365 session cookies to bypass multi-factor authentication, the extra login step that normally blocks stolen passwords.
• The takedown was led by the Frankfurt cybercrime prosecutor's office (ZIT) and Germany's Federal Criminal Police Office (BKA), with US support.

German and American police have pulled the plug on Kratos, a ready-made phishing kit that criminals rented to break into Microsoft 365 accounts. Indonesian police arrested the man investigators name as its developer and operator.

The joint announcement came on Monday from ZIT, Frankfurt's public prosecutor's cybercrime unit, and the BKA, Germany's Federal Criminal Police Office. German investigators describe Kratos as one of the world's most widely used criminal phishing kits. We first covered the BKA's involvement in this investigation on 21 July 2026, when investigators had already seized more than 200 servers and traced roughly 15,000 fake Microsoft login campaigns running every month.

A phishing kit is a bundle of software that does the hard work of running a scam: it hosts a fake login page, captures whatever the victim types, and forwards the stolen details to the buyer. Kratos was rented as a service, so a would-be crook needed no technical skill of their own.

What made Kratos different from an ordinary phishing page?

It was built to defeat multi-factor authentication, the second step (a code, a prompt, or a tap on an app) that is supposed to stop a stolen password from being enough.

Older phishing sites grabbed only the username and password. That's not much use against a well-configured Microsoft 365 account, because the attacker still hits a wall at the second step.

Kratos sat in the middle. When a victim typed their details into the fake page, Kratos relayed them to the real Microsoft login in real time. The victim then approved the second-step prompt on their phone, thinking they were signing in normally. What Kratos actually stole was the session cookie, the small file the browser receives after a successful login that tells Microsoft the user is already authenticated. Security researchers call this an adversary-in-the-middle attack.

With that cookie, a criminal could open the victim's mailbox and files from their own machine, without ever needing the password or the second-step code again.

Who was hit?

Kits like Kratos target businesses running on Microsoft 365. Once inside a mailbox, attackers typically hunt payment threads and send fake instructions to redirect wire transfers. It's the engine behind a large share of business email fraud.

As first reported by The Hacker News, the operation seized the kit's core servers, which should stop existing customers from using it, at least in its current form. History suggests copycats will appear: the economics are too good. The Forg365 kit we reported on 9 July had already shown how quickly new operations fill a gap.

What should ordinary users and staff do now?

If your employer uses Microsoft 365, expect your IT team to force a full sign-in over the coming days. That's standard after a takedown: it invalidates any session cookies criminals may still hold.

Be wary of emails asking you to reconfirm your Microsoft login through a link, even if the page looks perfect. The safer habit is to open a new browser tab and type office.com yourself.

Phone-prompt MFA wouldn't have stopped Kratos. Phishing-resistant methods, passkeys or hardware security keys built on the FIDO2 standard, are designed so the browser hands over credentials only to the real Microsoft domain. A fake page in the middle gets nothing.