Police seize 200+ servers, arrest Kratos phishing developer

A coordinated international law enforcement operation has disrupted the infrastructure of Kratos, a major phishing-as-a-service (PhaaS) platform, and led to the arrest of its alleged developer in Indonesia. The action, led by Germany's Federal Criminal Police Office (BKA) and the Frankfurt Public Prosecutor's Office's cybercrime unit (ZIT) in collaboration with U.S. and Indonesian authorities, resulted in the seizure of more than 200 servers, effectively disabling the service.

Announced on July -21, 2026, the takedown targeted what German investigators described as one of the world's most widely used criminal phishing kits. Authorities estimate that more than 1,800 paying customers used the Kratos platform to launch approximately 15,000 phishing campaigns per month, with each campaign potentially reaching thousands of recipients. The service operated on a subscription model, allowing even low-skill cybercriminals to conduct sophisticated attacks by renting the toolkit through a dedicated website and a Telegram shop.

The Kratos kit was designed to create convincing fake Microsoft 365 login pages. Its most dangerous feature was an "adversary-in-the-middle" mode that could bypass...