❗️ Kratos, one of the major M365 PhaaS operations, has been disrupted by German & US law enforcement. 200+ servers were taken down, according to BKA. Good news, but PhaaS operators rebrand, affiliates switch kits, and the same workflows return in new campaigns 🚨 🔍 Our report breaks down the phishing flow, infrastructure patterns, artifacts, and detection logic analysts can reuse when investigating similar campaigns: https://any.run/cybersecurity-blog/kratos-phaas-account-takeover/?utm_source=mastodon&utm_medium=post&utm_campaign=kratos_phaas_takedown&utm_content=linktoblog&utm_term=230726 #cybersecurity #infosec