Kratos PhaaS Targets Microsoft 365 Users With SharePoint Links and Cloudflare Anti-Bot Checks

Kratos, a subscription-based phishing-as-a-service platform, is targeting Microsoft 365 users in the United States, Europe, and other regions through campaigns designed to blend into ordinary document-sharing workflows.

The operation abuses trusted services, including Microsoft SharePoint, OneDrive, Microsoft Forms, Canva, Tilda, and systeme.io, to deliver links that ultimately redirect recipients to credential-harvesting pages.

Only 156 sessions had previously been labeled as Kratos, leaving 1,484 detections unattributed until the researchers developed a family-specific fingerprint.

An earlier branch, tracked as V0, contributed a further nine sessions.

The campaigns typically begin with messages claiming that a document, invoice, or DocuSign file has been shared.

In 114 analyzed cases, the phishing emails had already passed enterprise mail filters or secure email gateways before being sent to the sandbox.

SharePoint and OneDrive links were the most common delivery mechanism, appearing in 351 tasks.

After a victim follows the trusted link chain, Kratos deploys Cloudflare Turnstile to distinguish likely human visitors from automated scanners and sandbox systems.

The verification stage is followed by a fake Microsoft 365 login page. A recognizable pre-login screen shows an animated envelope, a blurred document or invoice background, and the message “Loading in progress…” Browser tabs commonly use the title “Authentication.”

The platform’s primary goal is Microsoft account theft. ANY.RUN found 1,3651{,}3651,365 sessions that led users toward pages impersonating login.live.com or microsoftonline.com, while 412 incidents were classified as fake Microsoft authentication pages.

Stolen credentials can enable business email compromise, invoice fraud, SharePoint and OneDrive data theft, and further attacks using a trusted corporate mailbox.

Kratos has evolved through three page generations. The V0 branch used a “Secure File Access” lure and submitted credentials to /PTT/SOft/mini.php. V1, the dominant branch with 1,397 sessions, imitates Microsoft’s sign-in interface and sends data to next.php, with observed variants including nex.php and n3xt.php.

ANY.RUN researchers identified that, 1,628 sandbox sessions associated with the operation across its primary variants. V2 uses obfuscated JavaScript and sends captured data through save.php.

Kratos PhaaS Targets Microsoft 365

Researchers said two assets offer a particularly reliable hunting signal for V1: barr.svg and lg.svg.

They appeared together in 1,397 sessions and only rarely occurred independently, providing roughly 90% recall with a near-zero false-positive rate in testing.

The V2 branch can be identified through the combination of dsa.svg, sid.gif, and imag.jpg.

The investigation also identified an operator-side Kratos panel active since at least September 2025.

The panel reportedly lets affiliates deploy phishing domains, upload page files, install TLS certificates, modify DNS settings, apply geographic restrictions, and select anti-bot controls such as reCAPTCHA, hCaptcha, or Cloudflare Turnstile. Operators can configure stolen-data delivery through Telegram bots or email.

Victim targeting spans more than 20 countries. ANY.RUN linked SharePoint tenant names in lures to 148 suspected organizations, with notable concentration in the United States, Spain, and Southern Europe.

Spanish-language URL tokens such as factura, abogados, and dgt suggest that some affiliates focus heavily on Spanish-speaking targets.

Security teams should hunt for paired requests to /assets/img/barr.svg and /assets/img/lg: svg, suspicious POST requests to next.php or save.php, and Microsoft-themed pages preceded by Turnstile verification.

Analysts should also treat WebSocket connections as a potential risk signal, though they do not independently prove adversary-in-the-middle session theft.

Once a user enters credentials, responders should revoke active sessions and refresh tokens, reset the password, investigate inbox rules and OAuth grants, review SharePoint and OneDrive access, and search for fraudulent email activity.

Password resets alone may be insufficient if attackers have already captured a valid session.

IOCs

Indicator	Type
dwbud.vilaribit[.]com	Subdomain / early domain associated with V0 (PTT/Soft)
41.128.0.142	IPv4 address — reported operator infrastructure, Egypt
abal[.]my	Domain
starwellmedia[.]com	Domain
aabiz[.]de	Domain
aspireglobal[.]ltd	Domain
buenne[.]de	Domain
dufllot[.]sbs	Domain
enerdizerandtron[.]de	Domain
espaciocf[.]de	Domain
ihrsupportcenter[.]de	Domain
ilersls[.]org	Domain
aaalen[.]de	Domain
rundwasser[.]de	Domain
smartcontrolengineer[.]com	Domain
sonnenbrillenspot[.]de	Domain
trisrnareprjdocz[.]com	Domain

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide