German and US authorities have taken down the infrastructure behind Kratos, a major phishing‑as‑a‑service platform, and the alleged developer has been arrested in Indonesia. The operation was led by Germany’s Federal Criminal Police Office and the Frankfurt public prosecutor’s cybercrime unit, working with US agencies and Indonesian police.
Kratos is described by investigators as one of the world’s most widely used criminal phishing services, with victims in 35 countries. The platform enabled low‑skill attackers to steal login credentials through convincing Microsoft‑themed phishing pages. Authorities said more than 1,800 criminal users relied on Kratos, launching around 15,000 phishing campaigns per month, each capable of targeting thousands of recipients.
Officials estimate the operator earned at least €300,000 since 2024 through subscription fees paid via a website and a Telegram‑based shop, with cryptocurrency among the accepted payment methods. As part of the takedown, law enforcement seized 200 servers, shutting down the service entirely.
Carsten Meywirth, head of the BKA’s cybercrime department, said the operation shows that even highly professional phishing infrastructures can be effectively disrupted and that criminals who steal credentials through fake websites “shouldn’t feel safe.”
