Kratos is a phishing-as-a-service operation built to steal Microsoft 365 credentials. It is targeting organizations across the United States, Europe, and other regions by using believable document, invoice, and file-sharing lures that lead victims to fake login pages.
The campaign puts a wide range of organizations at risk, including small businesses, law firms, schools, industrial firms, and public institutions.
A compromised Microsoft 365 account can expose email, SharePoint files, OneDrive data, payment conversations, and contacts that attackers may exploit for fraud.
The service is designed to make phishing deployment easier for affiliates. Its panel reportedly allows operators to set up phishing domains, configure stolen-data delivery, restrict campaigns by geography, and select anti-bot checks that make automated inspection more difficult.
Kratos PhaaS Attacking Microsoft 365 Users
Kratos usually starts with an email that claims a document has been shared, an invoice needs review, or a DocuSign action is waiting.
In 114 observed sessions, the malicious email had already passed through corporate email filters or secure gateways, showing why familiar-looking Microsoft 365 phishing messages still pose a serious risk.
Victims are often routed through trusted services before reaching the credential-stealing page.
SharePoint and OneDrive were the main delivery paths, but attackers also used Microsoft Forms, Canva, Tilda, systeme.io, and legitimate file-sharing services to make the chain appear less suspicious.
Before displaying its fake sign-in page, Kratos commonly presents a Cloudflare Turnstile verification screen. This step can help attackers filter out scanners and automated analysis tools, mirroring tactics seen in other anti-bot phishing operations.
The phishing page then imitates a Microsoft login window and commonly shows an animated envelope over a blurred document or invoice.
The browser tab is often titled “Authentication,” while the page displays a “Loading in progress” message before asking the victim to enter credentials.
Once submitted, credentials are sent to a server-side collection script. Some sessions also created WebSocket connections, which may indicate live credential relaying or an attacker-in-the-middle attempt, although researchers stressed that a WebSocket connection alone is not proof that a session was stolen.
Detection and Response
Kratos has evolved from a V0 “Secure File Access” lure into V1 and V2 pages that more closely imitate Microsoft sign-in screens. The newer versions use different page assets and collection routines, but shared domains and identical files connect them to the same broader operation.
The V1 pairing of barr.svg and lg.svg is the strongest known fingerprint. The files appeared together in 1,397 sessions and produced 90 percent recall with a false-positive rate close to zero in the researchers’ testing, making the pairing useful for threat hunts and SIEM detections.
Security teams should correlate asset requests, phishing-page behavior, credential collection endpoints, and delivery paths instead of relying on one weak signal. This matters because attackers frequently rotate domains, while recognizable kit components can remain stable across campaigns.
Defenders should block disposable attacker-controlled domains, but review shared parent domains before blocking them because legitimate content may also be hosted there.
Compromised websites should be reported for takedown, while broad cloud networks and Cloudflare infrastructure should be monitored rather than blocked wholesale.
For basic credential harvesting, responders should reset passwords and verify multifactor authentication settings.
For suspected session theft or AiTM phishing, teams should revoke active sessions and refresh tokens, inspect mailbox rules, and investigate unfamiliar sign-ins, since a password reset alone may not remove an attacker.
Indicators of Compromise (IoCs):-
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
