Kratos phishing animated envelope loading screen before fake M365 login

Duo Tech@duotech

•updated Jul 14, 2026•7•0•16

Detects network traffic containing a characteristic 'Loading in progress...' string, which is associated with the 'Kratos' animated envelope loading screen used in fake Microsoft 365 credential harvesting pages.