Topic starter
24/07/2026 4:06 pm
TL;DR: Authorities dismantled the Kratos phishing network after more than 1,800 cybercriminals used it for nearly 15,000 campaigns monthly, while researchers also showed its AitM mode could intercept session cookies and bypass MFA, according to SentinelOne and BKA. The lesson is that identity controls must account for session theft, not just password capture.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “The Good, the Bad and the Ugly in Cybersecurity – Week 30”.
Key questions
Q: What breaks when phishing can steal a valid session instead of just a password?
A: When phishing steals a valid session, MFA no longer guarantees safety because the attacker inherits the authenticated state rather than replaying credentials.
Q: Why do vaults and MFA still fail against adversary-in-the-middle phishing?
A: Because the attacker does not need to crack the vault or guess the password.
Q: What are the signs that a phishing campaign is being run through a phishing-as-a-service platform?
A: Common signs include multiple lookalike login pages, frequent rotation of domains and hosting, recurring use of the same payment rails, and infrastructure that stays online long enough to support many victims.
Practitioner guidance
- Harden against adversary-in-the-middle phishing Use phishing-resistant authentication where possible, but pair it with session-aware controls that can revoke live sessions when cookie theft is suspected.
- Instrument session revocation workflows Define operational steps for invalidating browser sessions, refresh tokens, and application sessions separately from password resets.
- Review conditional access for replay risk Require device, location, and token-binding signals that make stolen session reuse harder even after a user completes MFA.
Bottom line: Kratos shows that phishing-as-a-service is not just a social-engineering problem. It is a scalable identity-abuse model that turns reusable infrastructure into repeated account compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:11 pm
Phishing-as-a-service has become an identity abuse distribution channel: Kratos shows that the unit of risk is no longer the individual phish but the rented ecosystem that makes credential theft repeatable at scale. When more than 1,800 operators can reuse the same kit, defenders are dealing with industrialised identity compromise, not isolated social engineering. The practitioner conclusion is that phishing disruption must be paired with identity-layer resilience.
A question worth separating out:
Q: How should security teams respond when attackers steal a valid session instead of a password?
A: They should treat the session as compromised, not just the password. Contain the affected account, revoke tokens and cookies, inspect downstream SaaS and email activity, and look for reuse across other systems. Session theft often bypasses MFA entirely, so response has to focus on inherited trust, not the original login event.
👉 Read our full editorial: Kratos takedown shows phishing-as-a-service still scales via identity abuse