Kratos phishing service taken down, developer arrested

German and U.S. authorities say they have dismantled the core infrastructure behind Kratos, a major phishing-as-a-service platform, and arrested its developer in Indonesia. The operation seized more than 200 servers, a move investigators say has left the service inoperable.

The takedown was led by Frankfurt’s Prosecutor General Office (ZIT) and Germany’s Federal Criminal Police Office (BKA), working with U.S. law enforcement. According to the BKA, Kratos was “one of the world’s most widely used criminal phishing services,” with confirmed victims in 35 countries, especially across Europe and the United States.

Authorities said more than 1,800 criminal customers bought access to Kratos and used it to run roughly 15,000 phishing campaigns per month.

Recommended reading

Top AI models caught cheating in up to 14.1% of tests

“Authorities believe that more than 1,800 criminal customers purchased Kratos and used it to conduct roughly 15,000 phishing campaigns per month.”

The toolkit let attackers build and manage fake Microsoft login pages designed to steal email addresses and passwords. Investigators said access to compromised accounts was then used to commit further crimes, including likely business email compromise, data theft, account takeover, and follow-on phishing aimed at victims' contacts.

The BKA estimates the service’s owner made at least €300,000 ($342,000) in subscription revenue since 2024. With the technical administrator now under arrest and key infrastructure offline, the agency says the associated phishing campaigns can no longer continue.

A seizure banner posted on the site says the action was part of Operation Olympus Blade and that control of the domain has been transferred to the FBI. Investigators also expect the seized servers to yield forensic evidence that could help identify Kratos customers.

category: security

tags: [“security”, “phishing”, “cybercrime”, “law-enforcement”]

slug: “kratos-phishing-service-takedown”