[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$foXcWT5zNCEBtJ2UpV1LKZSPazeIuklrr37hmFqcePB0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"547f11a0-bf25-453c-a040-85577a6b506f","kratos-phishing-kit-bypasses-mfa-by-stealing-live-session-cookies","beec2163-b715-4046-8038-cdd21acd6cb3","Kratos Phishing Kit Bypasses MFA by Stealing Live Session Cookies","The Kratos phishing kit exploited an adversary-in-the-middle (AiTM) technique to intercept live Microsoft 365 session cookies after authentication, rendering traditional MFA controls ineffective. This matters because it exposes a critical gap in security posture: many organizations treat MFA as a silver bullet, unaware that session token hijacking can completely circumvent it. The scale of the operation — 1,800 paying customers and 15,000 monthly campaigns — demonstrates that AiTM toolkits are now commoditized and accessible to low-skilled threat actors. Organizations relying solely on push-based or TOTP MFA without phishing-resistant alternatives are broadly exposed to this class of attack.","**Immediate actions:**\n- Deploy phishing-resistant MFA (e.g., FIDO2\u002FWebAuthn hardware security keys or passkeys) to replace SMS- and push-based MFA for all critical accounts.\n- Enable Conditional Access policies that enforce token binding, device compliance checks, and sign-in risk scoring to detect anomalous session usage.\n- Implement Microsoft Entra ID's Continuous Access Evaluation (CAE) to revoke sessions in near-real-time when risk signals are detected.\n\n**Detection measures:**\n- Monitor for impossible travel, unfamiliar sign-in locations, and token replay events using SIEM alerts tied to identity provider logs.\n- Alert on session cookie reuse from new IP addresses or user agents that differ from the original authentication context.\n- Conduct regular threat hunting for AiTM indicators such as suspicious reverse-proxy infrastructure or unexpected OAuth token grants.\n\n**Long-term improvements:**\n- Adopt a Zero Trust architecture that continuously verifies device health, user identity, and network context rather than trusting authenticated sessions implicitly.\n- Train employees to recognize AiTM phishing lures (e.g., lookalike login pages) and establish a clear, low-friction reporting process for suspicious login prompts.\n- Regularly audit third-party SaaS application OAuth permissions to limit the blast radius of a compromised session token.",[12,13,14,15,16,17,18,19,20],"NIST SP 800-63B – Authenticator Assurance Level 3 (Phishing-Resistant MFA)","NIST SP 800-207 – Zero Trust Architecture","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","MITRE ATT&CK T1539 – Steal Web Session Cookie","MITRE ATT&CK T1557 – Adversary-in-the-Middle","GDPR Article 32 – Security of Processing (appropriate technical measures)","ISO\u002FIEC 27001:2022 A.8.5 – Secure Authentication",{},"published","2026-07-22T08:21:10.276542+00:00","2026-07-22T08:21:10.138+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fpolice-dismantle-kratos-phishing-kit.html","police-dismantle-kratos-phishing-kit-built-to-steal-microsoft-365-sessions-and-b-3cfa79","Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":37,"name":38,"slug":39,"description":40,"color":41},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":43,"name":44,"slug":45,"description":46,"color":47},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[50,54,58],{"slug":51,"name":52,"problem":53},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":55,"name":56,"problem":57},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":59,"name":60,"problem":61},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]