Kratos PhaaS Kit Targets Microsoft 365 Users Across US and EU

ANY.RUN researchers analyzed three generations of Kratos, a mature Phishing-as-a-Service kit built to steal Microsoft 365 credentials. Sandbox data revealed 1,628 sessions, of which only 156 had been previously tagged as Kratos while 1,484 remained unattributed. The research also exposed the kit's operator panel, automated deployment features, and anti-bot verification layers.

Kratos has hit at least 148 victim organizations across more than 20 countries, with the US, Spain, and Southern Europe showing the heaviest concentration. The attack chain typically begins with a trusted-service link via SharePoint or OneDrive, passes through Cloudflare Turnstile checks, and redirects to a fake Microsoft 365 login page marked by a distinctive animated envelope screen. Stolen credentials are exfiltrated via POST requests to generation-specific PHP endpoints such as next.php, save.php, or mini.php.

For defenders, the co-occurrence of two page assets — barr.svg and lg.svg — provides a high-confidence hunting fingerprint with roughly 90% recall and near-zero false positives. These findings support SIEM rule updates, retrospective threat hunts, and faster incident response to reduce risks of account takeover, business email compromise, and data exposure.