Executive Summary
Kratos is a mature Phishing-as-a-Service (PhaaS) operation that has been active since at least September 2025, specializing in the theft of Microsoft 365 credentials. The service operates on a subscription model, providing affiliates with an automated deployment panel to launch phishing domains, manage VPS infrastructure, and configure exfiltration via Telegram or email. Recent analysis has identified a significant concentration of victims in the United States and Southern Europe, particularly Spain, affecting sectors ranging from legal services to industrial organizations.
The attack chain typically involves phishing emails containing lures such as shared documents or invoices, which redirect victims through legitimate intermediary services like SharePoint or Canva. To evade automated detection, Kratos employs Cloudflare Turnstile and anti-bot checks before presenting a highly convincing fake Microsoft login page. The evolution of the kit through three generations (V0, V1, and V2) demonstrates a shift toward direct brand impersonation and the use of obfuscated JavaScript to bypass security signatures.
For organizations, the primary risk is rapid account takeover (ATO), which serves as a precursor to Business Email Compromise (BEC), financial fraud, and lateral movement within cloud environments. Because some generations may employ Adversary-in-the-Middle (AiTM) techniques like session relaying, traditional password resets may be insufficient to remediate active compromises.