# Kratos Is Down. Its Successor Is Probably Already in Beta.
German and American law enforcement dismantled the infrastructure behind Kratos this week — a phishing-as-a-service kit that prosecutors called one of the most widely deployed criminal toolkits in the world. Indonesian police arrested the developer they say built and operated it. The headlines read like a win. They are, mostly. But the architecture behind Kratos tells a story that outlasts any single arrest.
## What Kratos Actually Did
Kratos wasn't just a credential harvester. It was an adversary-in-the-middle (AiTM) operation — purpose-built to defeat multi-factor authentication by sitting between the victim and Microsoft 365's real login page in real time.
Here's the flow: a target receives a convincing phishing email with a link. They click. Kratos proxies a live Microsoft login session, showing the victim an authentic-looking page. The victim types credentials and approves their MFA prompt — phone tap, authenticator code, whatever. Kratos captures the session cookie on the way through. The victim gets logged into their actual Microsoft account, none the wiser. The attacker walks away with a valid authenticated session token that works until it expires, MFA irrelevant.
This matters because for years the security industry treated MFA as the answer to credential phishing. It's not. AiTM toolkits like Kratos are specifically engineered to invalidate that assumption, and they've done so at industrial scale.
## The Kit-as-a-Service Model
What made Kratos dangerous wasn't sophistication in the zero-day sense. It was accessibility. The kit was sold as a service — subscribers paid recurring fees and got access to a managed phishing infrastructure with ongoing updates, evasion improvements, and customer support. The operator handled hosting, detection bypass, and maintenance. The buyer needed only to point it at a target list.
That model is significant. It means a technically limited actor — someone who couldn't write a line of JavaScript — could run targeted Microsoft 365 account compromise operations against corporate environments. The skill floor dropped to zero. And because subscribers didn't host the infrastructure themselves, they were insulated from the kind of takedown that just happened. The BKA and ZIT can seize servers. They can't simultaneously arrest every subscriber.
## Frankfurt's Reach into Jakarta
Germany's ZIT — the Frankfurt cybercrime unit that has become one of Europe's sharpest weapons against criminal infrastructure — led the legal and technical effort alongside the BKA. US authorities contributed, likely through FBI, given Microsoft 365's American corporate parentage and the number of US victims.
The Indonesian arrest is the headline the prosecutors wanted. Naming and caging the developer carries deterrent value and sends a message to PhaaS operators that geographic distance isn't immunity. Indonesia has extradition relationships with the US, though enforcement has historically been uneven, and it remains to be seen how prosecution proceeds.
What's harder to say is whether this developer was the sole architect or one node in a development network. Prolific criminal kits often have multiple contributors, forked versions, and resellers who maintain independent copies. The infrastructure is dead. The codebase may not be.
## How Many Kits Are Left Standing?
Kratos existed in a crowded market. Evilginx, Modlishka, and dozens of less-public AiTM frameworks have been circulating in criminal communities for years. The 2022-era Caffeine and EvilProxy PhaaS platforms ran similar models — reverse-proxy phishing sold by subscription. Some were taken down. Others quietly evolved or rebranded.
After every high-profile takedown, the honest question is: how much of the criminal ecosystem depended on this specific kit versus how much will simply migrate to the next one? With commodity services like Kratos, the answer is often "not much." The subscriber base is portable. The techniques are documented. The void usually fills within weeks.
That's not an argument against the Kratos operation — taking down infrastructure absolutely matters, disrupts active campaigns, and removes a known-bad option from the market. But defenders should not treat this as a moment to exhale.
## For the Teams Defending Microsoft 365 Right Now
AiTM attacks specifically defeat SMS OTP, TOTP authenticator apps, and push-based MFA — the things most organizations deployed when they finally got serious about MFA. They don't defeat phishing-resistant MFA.
The FIDO2/WebAuthn family — hardware keys like YubiKeys, or passkeys bound to the device via platform authenticators — is the relevant countermeasure. These are cryptographically bound to the legitimate origin domain. A reverse proxy can't steal a credential that never gets transmitted to it.
Microsoft's own Conditional Access policies can also help here: requiring compliant devices, restricting authentication from unexpected geolocations, and enabling token protection features that bind session tokens to a specific device. None of these are default-on. Most Microsoft 365 environments haven't enabled them.
There's also detection. Successful AiTM attacks leave traces in sign-in logs — specifically, token-based authentications from IP addresses that weren't involved in the original authentication event. Microsoft Defender for Office 365 and Entra ID Protection surface these signals, but they require someone to be watching.
---
## HackWire Analysis
The Kratos takedown is a legitimate operational success, and the joint German-US-Indonesian effort deserves recognition. What it isn't is a strategic inflection point.
Phishing-as-a-service has matured into a genuine industry with subscription tiers, affiliate programs, and competitive differentiation. Kratos competed on reliability and MFA bypass capability. That market pressure — yes, market pressure, because criminal services compete for subscribers — will push successors to offer the same feature set faster, cheaper, and with better operational security baked in from the start. The developer learned what made Kratos findable. The next kit will be built with those lessons applied.
The deeper issue is that the security industry is running a playbook that's about two years stale. The broad push toward MFA in 2020 and 2021 was the right move, but it treated TOTP and push-based MFA as a destination rather than a waypoint. AiTM toolkits invalidated the assumption the moment the industry made it. The Kratos subscriber list is full of people who successfully compromised MFA-protected Microsoft 365 environments. That's the operational reality defenders are living in.
Phishing-resistant MFA is not a new concept. FIDO2 was standardized years ago. CISA has been recommending it explicitly since at least 2022. The adoption curve in mid-market enterprise — the sweet spot Kratos and similar kits targeted — is still shallow. That's where the exposure lives.
If this arrest prompts even a handful of CISOs to accelerate FIDO2 rollouts and enable Entra token protection, the takedown will have accomplished more than the press release implies. That's the outcome worth chasing.
— HackWire Editorial
---
## Related Coverage