Netcrook
#PhaaS
One Phishing Kit Fell, but Microsoft 365 Attackers Kept the Blueprint
The disruption of Kratos may have removed one criminal service, but the deeper problem is the reusable playbook behind modern Microsoft 365 account-takeover campaigns.
More Than 200 Servers Gone: The Kratos Takedown Exposes Phishing as a Business
A cross-border operation against Kratos did more than knock out infrastructure - it highlighted how phishing-as-a-service turns credential theft into a rented criminal utility.
Kratos Taken Down: What a Cross-Border Phishing Bust Reveals About Crime-as-a-Service
Germany, the U.S., and Indonesian authorities moved against the Kratos phishing platform, a reminder that modern credential theft often depends on rented infrastructure, not lone operators.
Trust-Path Phishing: Kratos Turns Microsoft 365 Sharing Into a Credential Trap
A subscription phishing kit is using familiar cloud-sharing patterns and bot checks to steer Microsoft 365 users toward fake sign-in pages.
Forg365 Turns Microsoft 365 Phishing Into a Bought-and-Sold Access Business
A Telegram-linked phishing service shows how identity theft now borrows the mechanics of SaaS, combining device-code abuse, token persistence, and AI-written lures.
Microsoft’s Device Code Flow Is Becoming a Rental Service for Account Takeovers
A late-June phishing run against Microsoft 365 shows how attackers are industrializing a legitimate sign-in method, turning trusted authentication into a reusable identity-abuse chain.
Kratos Phishing Grows Harder to Spot as Operators Refine the Login Trap
A newer Kratos PhaaS flow is drawing attention because it appears designed to look more like routine sign-in friction while reducing the cues defenders normally use to triage phishing.
Bluekit and the New Login Trap: When Phishing Starts Acting Like a Service Platform
A fast-moving phishing kit is being watched as it shifts from early testing to live deployment, with Microsoft sign-ins in its sights and proxy-style attacks at the center of the risk.
Inside the Phishing Factory: Why a Single Takedown Rarely Ends the Business
An INTERPOL-led operation disrupted Sniper Dz, a phishing-as-a-service platform, and the case shows how modern phishing is built like infrastructure, not just spam.
When Phishing Becomes a Service, the Browser Turns Into the Crime Scene
Campaigns tied to a SniperDz label show how brand spoofing, social lures, and browser-level tricks can turn everyday browsing into a repeatable fraud pipeline.