Kratos PhaaS credential exfiltration to alternate path (PTT/SOft/mini.php)

Duo Tech@duotech

•updated Jul 14, 2026•1•0•4

Detects HTTP POST requests directed at known Kratos Phishing-as-a-Service (PhaaS) URI paths, specifically 'PTT', 'SOft', or 'mini.php'. These paths are commonly associated with credential exfiltration activities.