Contained Medium impact Fraud Checked 22h ago

Police dismantle Kratos phishing-as-a-service network

German, US and Indonesian authorities took down more than 200 core servers used by Kratos, a phishing service that stole Microsoft 365 passwords and session cookies. Its alleged developer was arrested in Indonesia. On July 24, Indonesian police said 7,981 affected parties had been identified and that investigators were tracing other suspects, customers, victims, funds and infrastructure.

Started
Jul 21, 2026
Latest activity
Aug 5, 2026
Attributed to
Kratos phishing-as-a-service operatorsConfirmed
Where
Germany, United States, Worldwide
Sectors
Multiple sectors, Consumers, Finance
Scale
7,981 affected parties identified, including employees of government agencies, companies and organizations

Current status

No credible reporting or official statement after the FBI Dallas confirmation on 2026-08-05 was found through 2026-09-10.

Contained: The attack has been stopped or blocked. Recovery and investigation are still running.

Who is behind it

Germany's Federal Criminal Police Office (BKA) and the Frankfurt public prosecutor's cybercrime unit, working with US and Indonesian authorities, confirmed the takedown and the arrest of the alleged developer.

Impact

Kratos was used to steal Microsoft 365 passwords and session cookies that could let attackers get past ordinary MFA. Indonesian police said 7,981 affected parties had been identified and cited one suspected false-invoice case worth EUR 28,146.32. The central service remains contained while the investigation continues.

What to do

If you use Microsoft 365, turn on phishing-resistant multi-factor authentication, such as a hardware security key, since Kratos was built to steal session cookies and bypass ordinary MFA codes.

Timeline

  1. Aug 5, 2026

    FBI Dallas publicly confirmed its role in the joint takedown, said the operation was code-named Olympus Blade, and dated the server seizure to July 16, 2026, but reported no new arrests or victims beyond what was already known.

    Containedx.com
  2. Jul 24, 2026

    Indonesian police said 7,981 affected parties had been identified and that investigators were tracing other suspects, buyers, users, victims, funds and infrastructure.

    Containednews.detik.com
  3. Jul 23, 2026

    Security analysts cautioned that Kratos's roughly 1,800 customers and their target lists were not seized, so the disruption to phishing activity is likely temporary.

    Containedcsoonline.com
  4. Jul 22, 2026

    Reporting detailed the Node.js adversary-in-the-middle mode of the kit, which stole Microsoft 365 session cookies to bypass MFA, and said over 200 servers were seized.

    Containedthehackernews.com
  5. Jul 21, 2026

    German, US and Indonesian authorities announced they had dismantled the central Kratos infrastructure and arrested its alleged developer and administrator in Indonesia.

    Containedbleepingcomputer.com

Sources

Related reports