Police dismantle Kratos phishing platform behind 15,000 monthly campaigns

German and US law enforcement have dismantled the infrastructure behind Kratos, a notorious phishing-as-a-service (PhaaS) platform. Its alleged developer and administrator was arrested in Indonesia by local police.

Seizure banner (Source: BKA)

The takedown was led by the Frankfurt public prosecutor’s cybercrime unit (ZIT) and Germany’s Federal Criminal Police Office (BKA), working alongside US law enforcement. The suspect was arrested in Indonesia by local police.

Authorities describe Kratos as one of the “world’s most widely used criminal phishing services”, with victims confirmed in 35 countries, mainly in Europe and the US.

According to ZIT and BKA, Kratos gave low-skill cybercriminals a way to steal login credentials such as passwords and email addresses through convincing Microsoft-themed phishing pages.

“More than 1,800 criminal franchisees are believed to have acquired Kratos and used it to conduct approximately 15,000 phishing campaigns per month. Each individual campaign had the potential to harm several thousand recipients worldwide,” the German authorities said in a statement.

Authorities estimate the operator made at least €300,000 from subscription fees since 2024. Buyers paid through a website and a Telegram-based shop, with cryptocurrency among the accepted payment options.

During the operation, 200 servers were seized, shutting down the service.

“Anyone who steals login credentials online using fake websites shouldn’t feel safe. The success against the Kratos phishing kit shows that even highly professional phishing infrastructures can be effectively combated,” said Carsten Meywirth, Head of the Cybercrime Department at the BKA.