Police dismantle the Kratos phishing platform and arrest its developer

Authorities in Germany and the US have carried out a joint operation against Kratos — a platform that operated on a “phishing as a service” (PhaaS) model and had a global reach. The service's central infrastructure has been knocked out, and its developer has been detained in Indonesia.

During the operation, law enforcement seized more than 200 servers, which effectively rendered the service inoperable. The investigation was led by the Frankfurt Public Prosecutor's Office (ZIT) and Germany's Federal Criminal Police Office (BKA) in cooperation with their American counterparts. The BKA calls Kratos “one of the world's most widespread criminal phishing services”: confirmed victims have been recorded in 35 countries, primarily in Europe and the US.

The scale of the operation

Investigators estimate that the platform was purchased by more than 1,800 criminal clients, who ran roughly 15,000 phishing campaigns a month. Each such campaign could target several thousand recipients around the world.

Kratos's toolkit allowed attackers to create and maintain fake Microsoft authentication pages. The convincing login forms were designed to steal email addresses and passwords, opening the door to Microsoft accounts. The hijacked accounts, as the BKA notes, were often used for further crimes — compromising business correspondence, stealing data, taking over accounts, and sending phishing to the victims' contacts.

Investigators believe the service's owner earned at least €300,000 (about $342,000) since 2024 — from subscriptions to the platform.

What comes next

With the technical administrator arrested and the key infrastructure nodes shut down, continuing these campaigns has, according to the BKA, become impossible. A seizure banner has been placed on the service's website: the action was carried out as part of Operation Olympus Blade, and the domain has now been handed over to the control of the FBI.

The seized servers give investigators access to new evidence that may help establish the identities of the service's clients.

Source: Bleeping Computer