Kratos phishing-as-a-service dismantled: 200 servers, 1,800 customers, MFA walked past every time
German, US, and Indonesian authorities took down Kratos (tracked by Microsoft as SneakyLog), a phishing-as-a-service kit that used a Node.js reverse proxy to relay real Microsoft 365 logins and steal the resulting session, walking straight past two-factor authentication.
Frankfurt's cybercrime prosecution unit (ZIT), Germany's Federal Criminal Police Office, US law enforcement, and Indonesian authorities announced the takedown of Kratos, described as one of the world's most widely used criminal phishing kits and identified by Microsoft Threat Intelligence as SneakyLog. Kratos's core technique was an adversary-in-the-middle reverse proxy built in Node.js that relayed a victim's login to the real Microsoft 365 sign-in page in real time, then captured the session cookie that came back, credentials and MFA approval both, without ever presenting a fake password field. Investigators dismantled over 200 servers behind roughly 1,800 paying customers running about 15,000 campaigns a month, netting operators more than 300,000 euros since 2024 across hundreds of thousands of victims in 30-plus countries. An Indonesian national was named as the kit's developer and operator.
Why it matters
This is the same failure mode as device code phishing, a different mechanism, same result: the user authenticates on the genuine domain, MFA fires normally, and the attacker still ends up with a valid session rather than a password. Domain-reputation filtering and user training don't catch a proxy that is faithfully relaying the real login page back to a real server.
At 1,800 paying customers and 15,000 campaigns a month, this was never a niche tool, which is the actual lesson: phishing-resistant methods like passkeys that bind the credential to the origin defeat this by design, where a relayed password-plus-OTP flow cannot.
Source: The Hacker News