Kratos ecosystem shift changes threat-actor operations
Threat Actor Meta
Summary
Hide ▲
Show ▼
The Kratos phishing-as-a-service ecosystem was dismantled after it scaled to more than 1,800 criminal customers, exposing a subscription model that drove roughly 15,000 phishing campaigns per month. The service rented fake Microsoft login pages to cybercriminal buyers, enabling credential theft and downstream account takeover. Its reach extended across 35 countries, showing how criminal phishing infrastructure can turn a single platform into a global abuse channel.
Related Happenings
Midnight Blizzard CaptiveCrunch hospitality Wi-Fi phishing campaign
Campaign
H score37
First: 04.08.2026 03:17
Last: 04.08.2026 03:17
Sources 1
About this happening:
Microsoft linked CaptiveCrunch to Midnight Blizzard / APT29, a global operation that abuses hospitality Wi‑Fi to steal Microsoft 365 accounts and deliver malware....
Midnight Blizzard CaptiveCrunch hospitality Wi-Fi phishing campaign
CampaignAbout this happening: Microsoft linked CaptiveCrunch to Midnight Blizzard / APT29, a global operation that abuses hospitality Wi‑Fi to steal Microsoft 365 accounts and deliver malware....
Phishing becomes dominant initial access vector across Cisco Talos incident-response investigations, March-June 2026
Trend
H score30
First: 28.07.2026 16:00
Last: 28.07.2026 16:00
Sources 1
About this happening:
Phishing became the dominant initial access vector across incident-response investigations in March to June 2026, raising the risk of credential theft and follow-on co...
Phishing becomes dominant initial access vector across Cisco Talos incident-response investigations, March-June 2026
TrendAbout this happening: Phishing became the dominant initial access vector across incident-response investigations in March to June 2026, raising the risk of credential theft and follow-on co...
Hotel Wi-Fi DNS hijacking Microsoft 365 phishing campaign
Campaign
H score34
First: 24.07.2026 20:50
Last: 24.07.2026 20:50
Sources 1
About this happening:
Compromised Wi-Fi gateways at hotels and conference centers are redirecting travelers to fake Microsoft 365 login pages, creating a live credential-theft campaign that can...
Hotel Wi-Fi DNS hijacking Microsoft 365 phishing campaign
CampaignAbout this happening: Compromised Wi-Fi gateways at hotels and conference centers are redirecting travelers to fake Microsoft 365 login pages, creating a live credential-theft campaign that can...
Q2 2026 brand phishing expands to ChatGPT impersonation
Trend
H score35
First: 24.07.2026 14:15
Last: 24.07.2026 14:15
Sources 1
About this happening:
Phishing impersonation of technology brands rose in Q2 2026, with ChatGPT entering the top 10 of most impersonated brands for the first time and signaling growing atta...
Q2 2026 brand phishing expands to ChatGPT impersonation
TrendAbout this happening: Phishing impersonation of technology brands rose in Q2 2026, with ChatGPT entering the top 10 of most impersonated brands for the first time and signaling growing atta...
Germany-U.S. Kratos PhaaS takedown and developer arrest
Law Enforcement
H score39
First: 22.07.2026 02:07
Last: 22.07.2026 02:07
Sources 1
How related:
Authorities in Germany and the U.S. dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, and its developer was arrested in Indonesia.
About this happening:
Authorities in Germany and the U.S. seized more than 200 servers and arrested the developer of Kratos, a global phishing-as-a-service operation, disrup...
Germany-U.S. Kratos PhaaS takedown and developer arrest
Law EnforcementHow related: Authorities in Germany and the U.S. dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, and its developer was arrested in Indonesia.
About this happening: Authorities in Germany and the U.S. seized more than 200 servers and arrested the developer of Kratos, a global phishing-as-a-service operation, disrup...
Timeline
-
22.07.2026 02:07 2 articles · 13d ago
Kratos ecosystem shift changes threat-actor operations
Initial DisclosureA subscription-based Kratos phishing platform had already built a broad criminal customer base, with more than 1,800 buyers driving about 15,000 campaigns each month since 2024.
Show sources
- Police dismantle Kratos phishing platform, arrest developer — www.bleepingcomputer.com — 22.07.2026 02:07
- Police dismantle Kratos phishing platform, arrest developer — www.bleepingcomputer.com — 22.07.2026 02:07