Kratos takedown shows phishing-as-a-service still scales via identity abuse

At a glance

What this is: Authorities dismantled the Kratos phishing-as-a-service network, but the article’s key finding is that its real scale came from identity abuse, credential theft, and session-cookie interception that could bypass MFA.

Why it matters: This matters because IAM, PAM, and NHI programmes must defend the session layer and token lifecycle, not only the password prompt, when phishing services are built to survive basic authentication controls.

Context

Kratos was a phishing-as-a-service platform that packaged convincing Microsoft login pages and let customers run large-scale credential theft campaigns. The article links its disruption to law enforcement action, but the deeper governance problem is that identity abuse at the session layer can outlive the initial phishing page.

The article also shows why MFA alone is not enough when adversaries can intercept active session cookies through an adversary-in-the-middle proxy. In identity terms, the control gap is not authentication strength at sign-in, but the protection and revocation of authenticated sessions after the user has already passed the front door.

Key questions

Q: What breaks when phishing can steal a valid session instead of just a password?

A: When phishing steals a valid session, MFA no longer guarantees safety because the attacker inherits the authenticated state rather than replaying credentials. That breaks assumptions in access reviews, anomaly detection, and many conditional-access policies. Teams need controls that bind sessions to devices, detect token replay, and treat session abuse as a distinct identity threat.

Q: Why do vaults and MFA still fail against adversary-in-the-middle phishing?

A: Because the attacker does not need to crack the vault or guess the password. They only need to relay the login flow in real time, capture the authenticated session, and reuse it. If the second factor can be proxied, the control is vulnerable even when the user followed the expected steps.

Q: What are the signs that a phishing campaign is being run through a phishing-as-a-service platform?

A: Common signs include multiple lookalike login pages, frequent rotation of domains and hosting, recurring use of the same payment rails, and infrastructure that stays online long enough to support many victims. If investigators also see shared wallets, repeated cash-out behaviour, or links to other illicit services, that often points to a broader phishing-as-a-service operation rather than a one-off site.

Q: How should security teams respond when attackers steal a valid session instead of a password?

A: They should treat the session as compromised, not just the password. Contain the affected account, revoke tokens and cookies, inspect downstream SaaS and email activity, and look for reuse across other systems. Session theft often bypasses MFA entirely, so response has to focus on inherited trust, not the original login event.

Technical breakdown

How phishing-as-a-service industrialises identity abuse

Phishing-as-a-service lowers the skill bar by selling reusable infrastructure, templates, and operator tooling to many attackers at once. In Kratos, the service generated convincing Microsoft authentication pages and supported thousands of campaigns without each operator needing to build their own kit. That matters to defenders because the threat is not a single campaign, but a scalable distribution model for credential theft, unauthorized account access, and reuse of stolen identities across multiple operations. Practical implication: treat phishing infrastructure as an identity supply chain problem, not an isolated email problem.

Practical implication: monitor for repeatable phishing infrastructure patterns, not just individual messages.

Why adversary-in-the-middle bypasses MFA

AitM phishing sits between the user and the real service, relaying credentials and intercepting the authenticated session in real time. Once the victim completes MFA, the attacker can capture session cookies or token-bearing artifacts that represent an already authenticated state. That shifts the problem from password secrecy to session theft. In governance terms, the login step may succeed exactly as designed while the resulting session is still compromised. Practical implication: protect authentication sessions as first-class assets, because MFA does not end the threat at token issuance.

Practical implication: add session controls and token revocation to the response path, not just login hardening.

What active session theft changes for identity governance

The crucial security issue is not merely credential capture but the conversion of one authenticated moment into persistent access. Kratos campaigns used that foothold for business email compromise, lateral data theft, and secondary phishing, which shows how a single stolen session can become a broader identity abuse chain. For IAM and PAM teams, the lesson is that access review and password resets do not fully contain an already-issued session. Practical implication: design controls around session termination, conditional access, and replay resistance, not just authentication events.

Practical implication: build detection and containment around authenticated session abuse, not only account compromise.

Threat narrative

Attacker objective: The objective was durable unauthorized account access that could be monetized through email compromise, data theft, and further phishing.

1. Entry began with phishing-as-a-service operators using convincing Microsoft authentication pages to lure victims into credential submission and MFA completion.
2. Credential theft or session capture followed through traditional password harvesting or AitM interception of active session cookies in real time.
3. Escalation occurred when stolen sessions enabled unauthorized account access that could be reused for business email compromise, lateral data theft, and secondary phishing.
4. Impact was broader campaign execution at scale, with thousands of operators using the platform to run nearly 15,000 phishing campaigns monthly.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing-as-a-service has become an identity abuse distribution channel: Kratos shows that the unit of risk is no longer the individual phish but the rented ecosystem that makes credential theft repeatable at scale. When more than 1,800 operators can reuse the same kit, defenders are dealing with industrialised identity compromise, not isolated social engineering. The practitioner conclusion is that phishing disruption must be paired with identity-layer resilience.

MFA is necessary but no longer sufficient when session theft is the real prize: The article’s AitM example proves that an attacker can pass MFA and still leave with a usable authenticated session. That breaks the old assumption that successful sign-in equals safe access. The practitioner conclusion is that session protection, token binding, and rapid revocation must sit alongside MFA.

Session review assumptions fail when compromise is immediate: Traditional IAM governance assumes a session persists long enough to be observed, investigated, and certified. Kratos-style AitM attacks collapse that window because the session can be stolen at the moment of issuance and used before an access review ever occurs. The practitioner conclusion is that governance must move from post-authentication review to issuance-time containment.

Identity abuse now chains into secondary operations: The article shows stolen access being used for business email compromise, lateral data theft, and follow-on phishing. That means the first compromised identity is often just the staging point for broader trust exploitation across the enterprise. The practitioner conclusion is that response teams need to treat authenticated access as a launchpad for downstream misuse, not as the end state.

Credential theft and session theft should be separated in control design: Kratos demonstrates that password capture and cookie capture are different failure modes with different containment needs. A password reset addresses one; an active session invalidation addresses the other. The practitioner conclusion is that identity controls must classify which artefact was stolen before deciding how to remediate.

What this signals

Session theft is now the control boundary that matters: Identity programmes that stop at password hygiene miss the point of AitM phishing. If the attacker can leave with a valid session, the remaining question is how quickly the organisation can revoke and contain that trust artifact.

Phishing disruption and IAM hardening are now linked: Breaking the infrastructure matters, but the more durable defence is to make stolen authentication artifacts less reusable. That pushes identity teams toward phishing-resistant authentication, session binding, and faster invalidation paths.

Credential compromise and session compromise need different playbooks: Teams that use one response path for both will under-react to live session theft. The operational signal is whether responders can distinguish a password reset from a full session teardown and act accordingly.

For practitioners

• Harden against adversary-in-the-middle phishing Use phishing-resistant authentication where possible, but pair it with session-aware controls that can revoke live sessions when cookie theft is suspected.
• Instrument session revocation workflows Define operational steps for invalidating browser sessions, refresh tokens, and application sessions separately from password resets.
• Review conditional access for replay risk Require device, location, and token-binding signals that make stolen session reuse harder even after a user completes MFA.
• Detect phishing kit reuse and campaign scale Track repeated login-page infrastructure, cloned Microsoft branding, and high-volume campaign patterns as indicators of phishing-as-a-service activity.
• Separate credential compromise from session compromise in incident playbooks Document different containment paths for stolen passwords, stolen cookies, and delegated application access so responders do not under-respond to live-session theft.

Key takeaways

• Kratos shows that phishing-as-a-service is not just a social-engineering problem. It is a scalable identity-abuse model that turns reusable infrastructure into repeated account compromise.
• The article’s AitM example matters because it bypasses MFA by stealing the authenticated session, not by defeating the second factor directly.
• Teams need separate response paths for stolen passwords and stolen sessions, or they will keep remediating the wrong artefact.

Key terms

• Phishing-as-a-service: A criminal service model that packages phishing infrastructure, templates, delivery tools, and sometimes evasion features for reuse by multiple attackers. It lowers the skill threshold for advanced campaigns and makes targeted identity abuse more repeatable across victims and sectors.
• Adversary-in-the-middle phishing: A phishing method that places an attacker between the user and the real identity provider so the attacker can intercept or relay the authenticated session. It often preserves the user experience, which is why it can evade awareness and some detection paths while still producing usable session tokens.
• Persistent Cookie: A persistent cookie is a session cookie that remains valid after the browser closes until it expires or is explicitly removed. In remote access designs, it can improve usability, but it also increases the chance that a reused session becomes standing access if the organisation does not enforce compensating controls.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.