Law enforcement agencies from Germany, the US, and Indonesia teamed up to disable Kratos, a service that sold pre-assembled phishing pages to cybercriminals on a subscription basis. The operation removed more than 200 servers from the internet and resulted in the arrest of the platform’s alleged developer in Indonesia.
Kratos specialized in Microsoft-themed credential theft pages that could harvest both passwords and session cookies, effectively bypassing multi-factor authentication. Investigators say more than 1,800 affiliates used the service to run roughly 15,000 phishing campaigns every month, with confirmed victims in 35 countries across Europe, North America, and Asia.
Frankfurt’s cybercrime prosecution unit and Germany’s Federal Criminal Police Office led the investigation alongside US federal authorities. The platform generated subscription revenue estimated at $342,000 since 2024, processed through a website interface, Telegram bot, and cryptocurrency options.
The takedown marks the third major PhaaS disruption this year following operations against RaccoonO365 and EvilTokens. German authorities stated the seizure demonstrates that large-scale phishing infrastructure remains vulnerable to coordinated international law enforcement action regardless of operational complexity.
