Kratos takedown shows phishing-as-a-service still scales via identity abuse

At a glance

What this is: This is an analysis of the Kratos phishing network takedown and the identity risks exposed by phishing-as-a-service, including credential theft, session-cookie interception, and MFA bypass.

Why it matters: It matters because IAM and security teams still have to defend the account and session layer after passwords are no longer the only target, especially where phishing kits can industrialise access abuse at scale.

By the numbers:

• 1, ore than 1,800 cybercriminals utilized the platform to launch nearly 15,000 phishing campaigns monthly since late 2024.
• Authorities seized over 200 servers to render Kratos’ global network entirely inoperable.

👉 Read SentinelOne's analysis of the Kratos phishing network takedown

Context

Kratos is a phishing-as-a-service platform, which means operators rent a prebuilt kit to run credential theft campaigns without building the phishing infrastructure themselves. In this case, the platform industrialised Microsoft authentication lookalike pages and pushed both password harvesting and session interception at scale, turning identity abuse into a repeatable service.

For IAM and identity security teams, the important point is that the attack surface now extends beyond passwords into authenticated sessions. That changes the control problem: MFA alone does not end the issue if adversaries can capture cookies, reuse sessions, and operate inside the trust window that the identity system already opened.

Key questions

Q: How should security teams defend against phishing kits that steal MFA tokens and cookies?

A: Security teams should defend by adding controls that evaluate the login transaction itself, not just the password or one-time code. Use adaptive challenges, session integrity checks, and proxy detection so the attacker cannot complete the flow with harvested artefacts. The goal is to stop token replay before the session is accepted as legitimate.

Q: Why does session-cookie theft create more risk than password theft alone?

A: A stolen session cookie can already satisfy the checks that MFA was meant to strengthen, so the attacker may not need to log in again. That lets them access mail, files, and connected applications immediately, often before conditional access or user alerts trigger. The trust window is the real exposure.

Q: What do security teams get wrong about phishing-as-a-service?

A: They often treat it as an email problem when it is really an identity access problem. The kit, the proxy, and the subscription model all exist to convert authentication into durable access. Defenders need controls that detect and invalidate the session, not only block the message.

Q: Who is accountable when compromised cloud identity is used for business email compromise?

A: Accountability sits with the teams that govern identity scope, credential exposure, and service permissions across the cloud estate. IAM, security operations, and platform owners all have a role, because the abuse path usually depends on a permission decision made long before the incident. Regulatory and internal controls only work if those ownership boundaries are explicit.

Technical breakdown

How adversary-in-the-middle phishing bypasses MFA

Adversary-in-the-middle phishing works by placing a proxy between the victim and the real login page. The victim enters credentials and completes MFA against the genuine service, but the proxy captures the resulting session cookie or token. That means the attacker does not need to defeat MFA directly. They simply steal the post-authentication artefact that proves the session is already trusted. This is why modern phishing kits are so effective: they convert successful login into durable access, often before the user notices anything unusual. The identity layer has authenticated the person, but the session layer now belongs to the attacker.

Practical implication: Treat session theft as the control problem, not just password theft.

Why phishing-as-a-service scales credential abuse

Phishing-as-a-service lowers the barrier to entry by packaging infrastructure, templates, hosting, and targeting into a subscription model. Operators do not need deep technical skill to launch campaigns, and that changes the economics of identity abuse. Once a kit can generate convincing Microsoft login pages and support multiple theft modes, the network effect becomes the threat. More buyers means more campaigns, more telemetry noise, and more pressure on defenders to distinguish legitimate sign-ins from copied sign-in flows. The result is an access-abuse supply chain, not an isolated phishing event.

Practical implication: Build detection and response for campaign volume, not one-off phishing emails.

Why stolen sessions create downstream identity risk

A stolen session cookie can be more valuable than a password because it may already satisfy MFA and conditional access checks. From there, attackers can access email, internal files, and connected applications without re-authenticating. In environments with weak session binding, long-lived cookies, or limited token revocation, that foothold can persist long enough for business email compromise, lateral data theft, and secondary phishing. Identity governance has to follow the session, not stop at initial login. Otherwise, the attacker inherits the organisation's own trust decisions and turns them against the enterprise.

Practical implication: Shorten session lifetime and test how quickly compromised sessions can be revoked.

Threat narrative

Attacker objective: The attacker seeks authenticated account access that survives MFA so they can reuse trusted sessions for fraud, data theft, and further phishing.

1. Entry begins with a phishing-as-a-service campaign that lures victims to a convincing Microsoft authentication page and captures their credentials or session material.
2. Escalation occurs when the AitM mode intercepts active session cookies in real time, bypassing MFA and giving the attacker authenticated access without re-prompting the user.
3. Impact follows when those sessions are used for business email compromise, lateral data theft, and secondary phishing that extends the compromise beyond the first account.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• Gladinet Hard-Coded Keys RCE Exploitation — Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing-as-a-service turns identity abuse into a repeatable supply chain: Kratos shows that the threat is no longer a single malicious email but a rented access factory. Once credential theft and AitM interception are productised, defenders face scale, reuse, and fast rebranding after disruption. The practitioner implication is that phishing defence must be measured as a programme against industrialised account compromise, not as isolated user awareness.

Session cookies are now the real access artifact: Passwords remain the lure, but the session is the prize. When attackers can capture authenticated cookies in transit, MFA stops being the endpoint of assurance and becomes only one step in the chain. That shifts governance priority toward session lifetime, token revocation speed, and detection of impossible session provenance.

Identity trust is being exploited inside the trust window the organisation created: Kratos works because identity systems still assume that a successfully authenticated session is trustworthy until proven otherwise. That assumption fails when the attacker rides the trusted session itself, then uses it for mailbox abuse and lateral theft. The implication is that access assurance needs continuous session scrutiny, not just strong front-door authentication.

Phishing disruption does not equal identity remediation: The takedown of infrastructure reduces active campaign volume, but it does not remove the kit code already in circulation. That means operational resilience depends on how quickly an organisation can invalidate stolen sessions and recognise rebranded follow-on campaigns. The practitioner implication is to plan for adversary persistence after infrastructure seizure, not to assume network disruption ends the threat.

Combined credential and session theft should now be treated as a baseline NHI threat pattern: Although the victims are human accounts, the control failure spans human IAM, session management, and downstream connected applications. That crossover is where modern identity programmes break down: the initial login is secure enough, but the post-login artefact is not governed with equal seriousness. The practitioner implication is to join identity, PAM, and detection workflows around session abuse as one control plane.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
• That visibility gap is why teams should also study Ultimate Guide to NHIs , Key Challenges and Risks for the controls that close credential and access blind spots.

What this signals

Session theft is now the practical bridge between human IAM and NHI governance: once an attacker can reuse a trusted session, the control problem stops looking like user authentication and starts looking like post-authentication identity containment. Teams that already struggle with OAuth visibility will find the same blind spot in SSO sessions, connected apps, and mailbox trust paths.

The programme signal is clear: build identity monitoring around session provenance, not just login success. If your review cycle can see credential compromise but not cookie reuse, then the attack has already moved one layer deeper than your current control stack can observe.

Identity blast radius: this is the point at which one compromised account can reach email, files, and connected SaaS through the same trusted session. The remedy is not only stronger MFA but faster invalidation across the full identity chain, from login to downstream app consent.

For practitioners

• Harden session governance Shorten session lifetime, enforce token binding where possible, and test how quickly revoked credentials and cookies disappear from active applications.
• Detect AitM phishing patterns Add detections for sign-in flows that proxy genuine login pages, unusual cookie reuse, and access from freshly authenticated sessions that jump geography or device context.
• Rehearse mailbox compromise containment Create response steps for Business Email Compromise that include session invalidation, mailbox rule review, OAuth app checks, and secondary phishing suppression.
• Review third-party account exposure Map which SaaS and email-connected apps trust the same identity session and prioritise those with the widest blast radius if a cookie is stolen.

Key takeaways

• Kratos shows that phishing-as-a-service scales identity abuse by selling both credential theft and session interception.
• The scale was large enough to matter operationally, with more than 1,800 users of the platform and nearly 15,000 monthly campaigns since late 2024.
• Identity teams should focus on revoking and detecting compromised sessions quickly, because MFA alone does not neutralise AitM phishing.

Key terms

• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Phishing-as-a-service: A criminal service model that packages phishing infrastructure, templates, delivery tools, and sometimes evasion features for reuse by multiple attackers. It lowers the skill threshold for advanced campaigns and makes targeted identity abuse more repeatable across victims and sectors.
• Persistent Cookie: A persistent cookie is a session cookie that remains valid after the browser closes until it expires or is explicitly removed. In remote access designs, it can improve usability, but it also increases the chance that a reused session becomes standing access if the organisation does not enforce compensating controls.
• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.

What's in the full analysis

SentinelOne's full analysis covers the operational detail this post intentionally leaves for the source:

• The full reverse-engineering notes for the Kratos toolkit, including the two functional modes and how the AitM proxy works.
• Campaign specifics on tax-themed lures, QR-code delivery, and the industries targeted in the February activity.
• The law-enforcement angle around Operation Olympus Blade, including seizure scope and disruption mechanics.
• The write-up on how the kit code outlives infrastructure takedowns and what that means for rebranding risk.

👉 The full SentinelOne post covers the Kratos kit mechanics, campaign patterns, and disruption details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.