Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA

German and US law enforcement have taken down the core infrastructure of Kratos, described by German investigators as one of the world's most widely used criminal phishing kits, and Indonesian authorities arrested the man they say developed and ran it. In a joint announcement on Monday, the Frankfurt public prosecutor's cybercrime unit (ZIT) and Germany's Federal Criminal Police Office (BKA)

According to the article, German, US, and Indonesian authorities dismantled the core infrastructure of the Kratos phishing-as-a-service kit and arrested its alleged developer, after it was widely used to steal Microsoft 365 credentials, session cookies, and bypass MFA via convincing Microsoft-themed phishing pages.[11] External reporting further notes that Kratos, also known as SneakyLog/Sneaky 2FA, operated as a mature subscription-based phishing platform targeting organizations in the US and Europe with realistic document and file-sharing lures that led to fake Microsoft 365 login flows.[2][3][5][8][9] From a RealGround perspective, Kratos illustrates how turnkey criminal platforms industrialize account compromise at scale and can readily be adapted to target AI-backed business workflows and integrated SaaS environments if not continuously tested. Organizations should apply Continuous AI Red Teaming to simulate similar phishing and session-hijacking campaigns against their AI-driven systems and use Secure AI Agent Build to ensure agents and automations interacting with Microsoft 365 and other SaaS services enforce strong session validation, token binding, and robust MFA protectio