Researchers Map Kratos Phishing-as-a-Service Operation Targeting Microsoft 365

Jul 14, 2026 · Original article ↗

Summary

ANY.RUN researchers analyzed Kratos, a Microsoft 365 phishing service targeting organizations in the US, Europe, and elsewhere, and detailed its attack chain, infrastructure, indicators, and detection and response guidance.

Key points

Researchers identified 1,484 previously unattributed Kratos sandbox detonations and 148 suspected victim organizations based on SharePoint tenant names in phishing lures.
Kratos uses emails and trusted services such as SharePoint and OneDrive to direct victims to fake Microsoft 365 login pages, sometimes behind anti-bot checks.
The kit has three generations with distinct page assets and credential-exfiltration endpoints; some sessions showed WebSocket activity, which the article says does not by itself prove session theft.
An asset-pair fingerprint—barr.svg and lg.svg—provided 90% recall with a near-zero false-positive rate in negative-control testing.
OSINT uncovered an operator panel for deploying phishing domains, configuring delivery and anti-bot options, and managing infrastructure.
The article recommends using asset and behavior indicators for hunting, reviewing shared infrastructure before blocking it, and revoking sessions and refresh tokens when AiTM activity is suspected.

Article Details

Attack Vectors: Phishing emails lead victims through SharePoint, OneDrive, intermediary pages, or file-sharing services to Kratos phishing pages.
Kratos presents fake Microsoft 365 login pages and captures credentials through PHP endpoints; the endpoints vary by kit generation.
Some sessions establish WebSocket connections, which the article says may indicate credential relaying but do not prove session theft.
Operators can configure stolen data to be sent as JSON to a Telegram channel or by email.
Defensive Notes: Detect V1 pages by the barr.svg and lg.svg asset pair; detect V2 pages by dsa.svg, sid.gif, and imag.jpg appearing together. The article reports 90% recall and a near-zero false-positive rate for the V1 fingerprint in its testing.
Use the listed asset hashes, generation-specific exfiltration endpoints, and Kratos-specific engine signatures for detection and retrospective hunting.
Review suspicious links in a sandbox without entering real authentication credentials.
For basic credential harvesting, reset the password and verify MFA settings. For confirmed or likely AiTM activity, revoke active sessions and refresh tokens as well.
Block disposable attacker-controlled domains, but review shared parent domains and compromised legitimate websites carefully; monitor Cloudflare edge infrastructure rather than broadly blocking it.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`aaalen[.]de`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`aabiz[.]de`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`abal[.]my`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`aspireglobal[.]ltd`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`buenne[.]de`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`dufllot[.]sbs`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`dwbud[.]vilaribit[.]com`	Early Kratos V0 phishing domain associated with the /PTT/SOft branch.
DOMAIN	`enerdizerandtron[.]de`	Domain reported as serving Kratos V1 and V2 phishing pages.
DOMAIN	`espaciocf[.]de`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`ihrsupportcenter[.]de`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`ilersls[.]org`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`jumpast[.]es`	Domain reported as serving Kratos V1 and V2 phishing pages.
DOMAIN	`klenpare[.]com`	Identified as a wildcard domain used by Kratos deployments with rotating subdomains.
DOMAIN	`razen[.]online`	Domain reported as serving Kratos V1 and V2 phishing pages.
DOMAIN	`rundwasser[.]de`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`smartcontrolengineer[.]com`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`sonnenbrillenspot[.]de`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`starwellmedia[.]com`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`theoceanac[.]online`	Domain reported as serving Kratos V1 and V2 phishing pages.
DOMAIN	`trisrnareprjdocz[.]com`	Listed in the article's Kratos IOCs and artifacts.
DOMAIN	`uvarnix[.]cfd`	Identified as a wildcard domain used by Kratos deployments with rotating subdomains.
DOMAIN	`xavon[.]sbs`	Identified as a wildcard domain used by Kratos deployments with rotating subdomains.
IPV4	`41[.]128[.]0[.]142`	Identified by the article as an operator IP associated with Kratos.
SHA256	`949895df17148c5ea29f190d2619a14b3ec648425b9cc3c5a1423553c16f3898`	Hash of the Kratos barr.svg asset, used as a detection indicator.
SHA256	`9d1a1a5e3b5e5de8a6c76ded7a01fa01709d426232b0048c9ee6ba0c5c1b8b42`	Hash of the Kratos ani.gif asset, used as a detection indicator.
SHA256	`a3c298ccf2456989ceb080e661b01c3b00445902ae7bb3e58dad4d846334ff9c`	Hash included in a Kratos V2 threat-intelligence query.
SHA256	`c447e75f1029ed7a5882add16bcd13ad44be3bd47c93c830ff39185e23d25ebb`	Hash of the Kratos styles.css asset, used to link activity across V1 and V2.
SHA256	`cd231b895bbcd7154b81df1e065bf02f1ec667b920c8b6d23308cd509833b5ea`	Hash of the Kratos lg.svg asset, used as a family fingerprint.