German police take down the Kratos phishing platform

Germany, with support from the United States and Indonesia, has struck at the phishing-as-a-service platform Kratos. The service has been in active use across the US and Europe since 2024 and has earned its operators more than 300,000 euros. The operation, led by Germany's Federal Criminal Police Office (BKA), took down more than 200 servers, and the platform's developer and technical administrator were arrested with assistance from Indonesian law enforcement.

What this means for you if you own login security

Phishing-as-a-service is why the quality of fraud attempts has risen over recent years. Buyers with no technical skill get convincing pages and ready-made infrastructure. As we read it, that means your controls are meeting attempts that look professional, because they are. That is the part worth taking away from this case.

A takedown like this buys breathing room, but our assessment is that the market refills quickly. The threat has not gone away because a developer has been arrested. What decides the outcome on your side is whether your login can withstand an employee being fooled. If your controls assume that nobody ever falls for an attempt, you have placed your security somewhere you do not control.

Berigo recommends

• Check whether any users still rely on SMS or one-time codes as their only second factor, and move them to phishing-resistant methods.
• Set up monitoring for newly registered domains resembling your own name and brand.
• Give staff a simple, fast channel for reporting suspicious logins, without fear of having done something wrong.
• Test how long it takes from a member of staff reporting an incident to you actually locking a compromised account.

Source

• bka.de