Kratos phishing kit

One session carries the visitor through password and MFA

Kratos affiliates sent phishing links to hosted Microsoft 365 login pages, sometimes after a fake document or browser check. The collector starts with a username, asks for the password and then offers the available verification methods. Its SMS screen takes the texted code. Its Authenticator screen asks for approval or number matching and polls the server for the result.

A securityToken ties those screens to one visit. The page loads each step through js/module.php?m=auth&t=, adding a per-copy token and the submitted value. A hidden field sits off screen as a submission trap, and the page disables text selection and the context menu.

Random names hide a stable Kratos controller

The September and October copies use different CSS classes, element IDs, function names and page titles. A mapping object connects stable jobs such as validateUsername, validatePassword, validateVerificationCode and pollAppVerification to the randomized names used by that copy. The surrounding identifiers changed between captures while the controller map, securityToken and module route remained recognizable.

Public reporting also describes a reverse-proxy mode that passed the visitor's Microsoft traffic through the kit and retained the authenticated session. That mode used its own small asset and endpoint set, including barr.svg, lg.svg, next.php and save.php.

The code remained after the central takedown

Kratos developed from Sneaky 2FA. Trend Micro reported that German and US authorities took its central infrastructure offline on 20 July 2026. Our records begin on 18 September, showing that a deployed copy of the collection page remained reachable after the service disruption.

What we see

Month	New sites
September	1
October so far	1

The latest Kratos match in this snapshot was 7 October. 2 sites matched in the last 30 days.

Checking a site for Kratos

Inspect the complete link and record its requests. Look for:

• securityToken shared across username, password and verification screens
• a js/module.php?m=auth&t= request for each submitted step
• stable validation and Authenticator polling labels mapped to random function names
• the prompt We texted your phone in the SMS branch
• the reverse-proxy assets and PHP post routes described above

Remove the collector, proxy and server routes. Review the account that deployed them, revoke affected Microsoft sessions and rotate the site's hosting credentials.