Threats · 54 days ago
Shutting down Kratos is only the first step. When authorities seize the platform’s central infrastructure, they may also recover the subscriber data and campaign material that show who used it and how they ran phishing operations.
Germany and U.S. authorities dismantled Kratos’ core infrastructure and arrested its developer in Indonesia. Kratos was a phishing-as-a-service platform with global reach, so the seizure is more than a single disruption.
The bigger risk for the ecosystem is follow-on exposure. If investigators can tie subscribers to templates and infrastructure, one takedown can turn into multiple cases against related phishing crews and customers.
3 sources covering this story
Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA
Authorities seize 200 Kratos servers and arrest its alleged developer and operator; investigators estimate 15,000 campaigns ran monthly.
Police dismantle Kratos phishing platform behind 15,000 monthly campaigns - Help Net Security
German and US police carry out a Kratos phishing platform takedown, seizing servers and arresting its developer in Indonesia.
Police dismantle Kratos phishing platform, arrest developer
dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, and its developer was arrested in Indonesia.
Part of the PlainSec briefing for 2026-07-22