German and US authorities dismantle global Kratos phishing service

German and U.S. law‑enforcement agencies, including the Federal Criminal Police Office (BKA), the Frankfurt cybercrime unit (ZIT) and U.S. authorities, seized more than 200 servers and shut down the infrastructure of the Kratos phishing‑as‑a‑service platform. The operation also led to the arrest of the service’s alleged developer and technical administrator by Indonesian police.

Kratos was used by roughly 1,800 criminal “franchisees” to launch about 15,000 phishing campaigns each month, targeting victims in more than 30 countries, mainly across Europe and the United States. The service generated over €300,000 in revenue since 2024 by offering a ready‑made kit for creating Microsoft‑style login pages that harvest credentials. With the infrastructure disabled, the supported campaigns can no longer be conducted.