Kratos ecosystem shift changes threat-actor operations
Threat Actor Meta
Summary
Hide ▲
Show ▼
The Kratos phishing-as-a-service ecosystem was dismantled after it scaled to more than 1,800 criminal customers, exposing a subscription model that drove roughly 15,000 phishing campaigns per month. The service rented fake Microsoft login pages to cybercriminal buyers, enabling credential theft and downstream account takeover. Its reach extended across 35 countries, showing how criminal phishing infrastructure can turn a single platform into a global abuse channel.
Related Happenings
Germany-U.S. Kratos PhaaS takedown and developer arrest
Law Enforcement
H score39
First: 22.07.2026 02:07
Last: 22.07.2026 02:07
Sources 1
How related:
Authorities in Germany and the U.S. dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, and its developer was arrested in Indonesia.
About this happening:
Authorities in Germany and the U.S. seized more than 200 servers and arrested the developer of Kratos, a global phishing-as-a-service operation, disrup...
Germany-U.S. Kratos PhaaS takedown and developer arrest
Law EnforcementHow related: Authorities in Germany and the U.S. dismantled the central infrastructure of Kratos, a phishing-as-a-service (PhaaS) platform with global reach, and its developer was arrested in Indonesia.
About this happening: Authorities in Germany and the U.S. seized more than 200 servers and arrested the developer of Kratos, a global phishing-as-a-service operation, disrup...
Forg365 PhaaS industrializes Microsoft 365 credential theft and session hijacking
Threat Actor Meta
H score36
First: 13.07.2026 16:03
Last: 13.07.2026 16:03
Sources 1
About this happening:
Forg365 has emerged as a subscription-based phishing platform that lowers the barrier to Microsoft 365 account theft while scaling session hijacking and mailbox ab...
Forg365 PhaaS industrializes Microsoft 365 credential theft and session hijacking
Threat Actor MetaAbout this happening: Forg365 has emerged as a subscription-based phishing platform that lowers the barrier to Microsoft 365 account theft while scaling session hijacking and mailbox ab...
Forg365-ForgCookie alliance reshapes ransomware ecosystem operations
Threat Actor Meta
H score37
First: 09.07.2026 17:39
Last: 09.07.2026 17:39
Sources 1
About this happening:
Forg365 is a phishing-as-a-service (PhaaS) operation built to steal Microsoft 365 accounts with AiTM and device-code phishing, increasing credential-theft risk...
Forg365-ForgCookie alliance reshapes ransomware ecosystem operations
Threat Actor MetaAbout this happening: Forg365 is a phishing-as-a-service (PhaaS) operation built to steal Microsoft 365 accounts with AiTM and device-code phishing, increasing credential-theft risk...
FIFA-themed phishing-as-a-service market selling scam kits and ticket-buying bots
Threat Actor Meta
H score42
First: 05.06.2026 10:01
Last: 05.06.2026 10:01
Sources 1
About this happening:
A FIFA-themed phishing-as-a-service market is selling ready-made scam kits and ticket-buying bots, lowering the barrier for fraud operators and making takedowns less e...
FIFA-themed phishing-as-a-service market selling scam kits and ticket-buying bots
Threat Actor MetaAbout this happening: A FIFA-themed phishing-as-a-service market is selling ready-made scam kits and ticket-buying bots, lowering the barrier for fraud operators and making takedowns less e...
Triad Nexus expands fraud ecosystem and shifts into emerging markets after 2025 US sanctions
Threat Actor Meta
H score43
First: 14.04.2026 15:00
Last: 14.04.2026 15:00
Sources 1
About this happening:
Triad Nexus expanded its fraud ecosystem after US Treasury sanctions in 2025, increasing operational scale and shifting into emerging markets. The network’s use of U...
Triad Nexus expands fraud ecosystem and shifts into emerging markets after 2025 US sanctions
Threat Actor MetaAbout this happening: Triad Nexus expanded its fraud ecosystem after US Treasury sanctions in 2025, increasing operational scale and shifting into emerging markets. The network’s use of U...
Timeline
-
22.07.2026 02:07 2 articles · 2h ago
Kratos ecosystem shift changes threat-actor operations
Initial DisclosureA subscription-based Kratos phishing platform had already built a broad criminal customer base, with more than 1,800 buyers driving about 15,000 campaigns each month since 2024.
Show sources
- Police dismantle Kratos phishing platform, arrest developer — www.bleepingcomputer.com — 22.07.2026 02:07
- Police dismantle Kratos phishing platform, arrest developer — www.bleepingcomputer.com — 22.07.2026 02:07