Police shut down Kratos, the phishing kit built to hijack Microsoft 365 logins

Key points

• German and US law enforcement seized the core servers of Kratos, a phishing kit that German investigators call one of the most widely used criminal tools of its kind, in an operation announced on Monday.
• Indonesian authorities arrested the man they say built and ran the service.
• The kit was designed to steal live Microsoft 365 sessions and get around multi-factor authentication, the extra login step that normally blocks stolen passwords.
• The takedown was led by the Frankfurt cybercrime prosecutor's office (ZIT) and Germany's Federal Criminal Police Office (BKA), with US support.

German and American police have pulled the plug on Kratos, a ready-made phishing kit that criminals rented to break into Microsoft 365 accounts. Indonesian police arrested the man investigators name as its developer and operator.

The joint announcement came on Monday from the Frankfurt public prosecutor's cybercrime unit, known as ZIT, and Germany's Federal Criminal Police Office, the BKA. German investigators describe Kratos as one of the world's most widely used criminal phishing kits.

A phishing kit is a bundle of software that does the hard work of running a scam. It hosts a fake login page, captures whatever the victim types, and sends the stolen details back to the buyer. Kratos was rented out as a service, so a would-be crook did not need any technical skill of their own.

What made Kratos different from an ordinary phishing page?

It was built to defeat multi-factor authentication, the second step (usually a code, a prompt on your phone, or a tap on an app) that is supposed to stop a stolen password from being enough.

Older phishing sites just grabbed the username and password. That is not much use against a well-configured Microsoft 365 account, because the attacker still gets stopped at the second step.

Kratos worked differently. It sat in the middle. When a victim typed their details into the fake page, Kratos passed them through to the real Microsoft login in real time. The victim then approved the second-step prompt on their phone, thinking they were signing in as normal. What Kratos actually stole was the session cookie, the small file the browser gets after a successful login that tells Microsoft "this person is already signed in, let them through".

With that cookie in hand, a criminal could open the victim's mailbox, files and chats from their own machine, without ever needing the password or the second-step code again. Security researchers call this style of attack "adversary in the middle".

Who was hit?

Kits like Kratos are aimed mainly at businesses that run on Microsoft 365, which is most of the office world. Once inside a mailbox, attackers typically read invoices, hunt for payment threads, and send fake instructions to redirect wire transfers. It is the engine behind a large share of business email fraud.

As first reported by The Hacker News, the operation seized the kit's core servers, which should stop existing customers from using it, at least in its current form. History suggests copycats will appear. The economics are too good.

What should ordinary users and staff do now?

If your employer uses Microsoft 365, expect your IT team to force everyone to sign in again over the coming days. That is normal after a takedown of this kind: it invalidates any session cookies the criminals may still be holding.

Be wary of emails asking you to "reconfirm" your Microsoft login through a link, even if the page looks perfect. The safer habit is to open a new browser tab and type office.com yourself.

And honestly, would MFA have helped here? Not the phone-prompt kind. Phishing-resistant methods, such as passkeys or hardware security keys that follow the FIDO2 standard, are designed so the browser will only hand over credentials to the real Microsoft domain. A fake page in the middle gets nothing.