Kratos Phishing Kit: How Two Image Files Betray Microsoft 365 Attacks

In late July 2026, cybersecurity researchers at ANY.RUN uncovered a surprisingly simple way to spot one of the most persistent phishing operations targeting Microsoft 365 users. The Kratos phishing-as-a-service (PhaaS) platform, which has been harvesting credentials through fake sign-in pages, leaves behind a pair of telltale image files—barr.svg and lg.svg—in nearly every attack. That fingerprint now enables defenders to identify thousands of previously hidden incidents without relying on easily changeable domain names.

A Smoking Gun in Page Assets

The ANY.RUN team examined 156 sandbox sessions originally tagged as Kratos and noticed that the landing pages consistently loaded the same set of files from an /assets/ directory. Two files stood out: /assets/img/barr.svg and /assets/img/lg.svg. In a retrospective hunt across all their sandbox data, these two files appeared together in 1,397 sessions—and only 14 times apart, giving the indicator a 90% recall rate with virtually no false positives.

That single correlation led them to reclassify 1,484 additional sessions that had previously been detected as generic phishing but never attributed to a specific family. The campaign had been hiding in plain sight, flagged only as “Generic Phishkit related URL chain observed” or “Domain chain identified as Phishing.” Now it has a name.

Kratos exists in three known versions, dubbed V0, V1, and V2. V1 is by far the most active (1,397 sessions), while V2 accounts for 231 sessions, and V0 a mere 9. Each version has a distinct set of static assets and exfiltration endpoints:

The versions share infrastructure and code, confirming they are generations of the same kit, not separate operations. For example, the lg.svg file in V1 is byte-for-byte identical to dsa.svg in V2, and the styles.css hash connects 636 tasks across both generations.

Microsoft 365 Users and Admins: What’s at Stake

For the average Microsoft 365 user, Kratos represents a sophisticated fraud designed to look exactly like a real Microsoft login page. The attack typically starts with a phishing email—often a fake invoice or document share via SharePoint, OneDrive, or other trusted services—that passes through corporate email filters. Clicking the link leads to a Cloudflare Turnstile anti-bot check, then a fake authentication page that is pixel-perfect. The page even limits password attempts to three before showing an “incorrect password” error, mimicking legitimate behavior.

But for IT administrators and security teams, the risk goes beyond a stolen password. Some Kratos sessions establish WebSocket connections, a potential sign of adversary-in-the-middle (AiTM) attacks that can capture session cookies or tokens. If an attacker gets a valid session, a simple password reset won’t evict them—they can continue accessing mailboxes, SharePoint, and OneDrive until the session expires or is explicitly revoked.

The campaign’s victimology is broad: ANY.RUN identified 148 suspected victim organizations, with a concentration in the US and Southern Europe (especially Spain). Industries targeted include legal, education, manufacturing, and others. The messages are tailored, with Spanish-language tokens like “factura” (invoice) and “abogados” (lawyers) appearing in URLs.

For SOC teams, the most immediate concern is that this activity has been flying under the radar. Even with generic phishing detections triggering, the lack of family-level attribution meant incidents might not have been escalated or correlated. Now that a simple and accurate fingerprint exists, organizations can retrospectively hunt down these compromises and improve forward detection.

The Rise of Phishing-as-a-Service and Kratos' Evolution

Kratos is not a lone hacker; it’s a commercial operation selling turnkey phishing capabilities. The admin panel, discovered through OSINT by checking favicons and page titles, reveals a slick “Kratos” login page with copyright 2026 and the tagline “Enter the realm of power.” Operators can deploy a phishing domain to a VPS with a few clicks, choose between a PHP-based Office 365 page or a Node.js reverse proxy with anti-bot protection, configure Telegram or email delivery of stolen credentials, and even set geographic restrictions.

The panel has been active since at least September 10, 2025. However, the sandbox data shows a steady rise in Kratos sessions in 2026: from 93 in January to 393 in June (with July partial at 10). The kit has evolved significantly. V0 presented a generic “Secure File Access” page asking for email verification. V1 shifted to direct Microsoft 365 impersonation, with code comments suggesting the goal was to mimic Microsoft’s sign-in more closely and evade existing signatures. V2 further obfuscated its code and adopted jQuery 4.0 beta.

The infrastructure patterns indicate multiple affiliates. Some use disposable domains on cheap TLDs (.horse, .cfd, .sbs), others compromise legitimate WordPress sites (especially .de and .es domains). A notable cluster uses subdomains with “bgados” (from “abogados”), pointing to legal-themed lures. The same VPS servers and SharePoint pages sometimes host other AiTM kits like Tycoon and EvilProxy, but Kratos is distinct—those competitors don’t serve barr.svg.

This operational maturity means that traditional domain blocklists are ineffective. Affiliates can rotate domains daily or hide behind compromised sites. What doesn’t change? The static assets that make the phishing page look convincing.

From Detection to Response: Actionable Steps

Detection is step one. Defenders should implement a combination of indicators, not just a single rule, to avoid noise.

Hunt for the asset fingerprint
In your proxy, DNS, or sandbox telemetry, look for HTTP requests that include both */assets/img/barr.svg and */assets/img/lg.svg in the same session. This alone gives very high confidence. For V2, the pattern is *dsa.svg, *sid.gif, and *imag.jpg. Use these content hashes to match even if file names are altered:

• lg.svg: SHA256: cd231b895bbcd7154b81df1e065bf02f1ec667b920c8b6d23308cd509833b5ea
• barr.svg: SHA256: 949895df17148c5ea29f190d2619a14b3ec648425b9cc3c5a1423553c16f3898
• styles.css: SHA256: c447e75f1029ed7a5882add16bcd13ad44be3bd47c93c830ff39185e23d25ebb (connects V1 and V2)

Correlate with exfiltration
A POST request to */next.php, */save.php, or */officers*eur.php after those assets load adds significant confidence. A standalone next.php request is not proof, but the combination is strong.

Use a scoring model
Instead of a binary block, assign points in your SIEM:

• +80 for the asset pair
• +80 for matching hash
• +35 for the exfil POST
• +30 for “Fake Microsoft Authentication Page” signature or page title “Authentication”
• +15 for Turnstile before login
• +10 if the lure came through SharePoint or an email gateway
• –80 if indicators of another kit (e.g., stealc, vidar) are present

Investigate in a sandbox
When a suspicious link is found, analyze it in an interactive sandbox (like ANY.RUN). Never enter real credentials. Look for the in-browser behavior: the submitData() function, password-attempt handling, and redirects.

Tailor the response to the type of compromise

• Credential harvest only: Reset the user’s password, review and reset MFA methods, check for suspicious inbox rules or forwarding.
• Suspected session/token theft: Immediately revoke all active sessions and refresh tokens for the affected user (Entra ID: block sign-ins, revoke sessions). A password reset is not enough. Then, audit recent activity across Microsoft 365 services.

Adjust email and browser protections
Microsoft recommends Standard or Strict preset security policies in Defender for Office 365, which enable Safe Links, Safe Attachments, and advanced anti-phishing. Verify spoof and impersonation protection, especially if third-party mail gateways are used. However, Kratos often bypasses email filters by hosting the initial lure on legitimate services; therefore, endpoint and network detection are critical.

For CISOs: update playbooks

• Measure time to confident attribution, not just time to detection. Link related alerts to understand campaign scope.
• Add browser-level investigation to phishing workflows: analysts need to see page code, DOM changes, and credential-exfiltration behavior.
• Define separate playbooks for credential harvesting vs. AiTM. Train SOC staff to recognize the difference and escalate token theft incidents immediately.
• Turn Kratos indicators into repeatable controls: add the asset fingerprint and hashes to your detection engineering pipeline for retro hunts and continuous monitoring.

What Comes Next

Kratos will continue to evolve. Adversaries are already using V2 with obfuscated code and new jQuery libraries; a V3 may appear soon with different assets. The kit’s admin panel and affiliate model make it accessible to a wide range of criminals, so the geographic and sector targeting will likely expand.

However, the core lesson is not about Kratos exclusively. The takedown of one kit will not stop phishing. Defenders should use this case to improve their muscle memory: focus on low-noise, high-fidelity indicators that survive infrastructure changes. The file-based fingerprint approach can apply to other kits if analysts look for static assets that are expensive for attackers to change.

For Microsoft 365 users, the advice remains constant: treat every login prompt with suspicion, especially when it arrives via an unexpected email. But security teams now have a sharper tool. Those two little image files—barr.svg and lg.svg—are the kind of simple, reliable signal that turns a hidden campaign into a solvable problem.