Kratos Kit Used W-2 QR Phish to Hijack M365

How the attack worked

The Kratos phishing kit, also tracked as SneakyLog, powered a large-scale credential theft operation before law enforcement took down its core infrastructure. In one documented campaign, operators sent tax-themed emails to about 100 organizations, each carrying a W-2 document with a QR code personalized to the recipient. Scanning the code led victims to a fake Microsoft 365 login page. Because the lure arrived as a document rather than a direct link, it slipped past habits people use to spot suspicious emails, such as hovering over links.

Why it succeeded

Kratos supported two collection modes. One was a simple credentials-only page. The other was a Node.js reverse proxy designed to relay the login to Microsoft in real time and capture the resulting session. This adversary-in-the-middle setup meant the kit was not just harvesting typed passwords, it was intercepting a live, authenticated session. That cookie is enough to walk past two-factor authentication into the account as the user, which explains why MFA alone did not stop account takeover in these cases. The kit's scale, reportedly used by roughly 1,800 paying customers to run about 15,000 phishing campaigns a month, also made lookalike pages common and hard to fully block through denylisting alone.

What to watch for

• Unexpected tax season or payroll messages, especially W-2 documents, that were not initiated by HR or payroll
• A QR code used as the primary way to reach a form or login page instead of a normal link or bookmark
• A Microsoft 365 sign-in page reached through an email or QR code rather than a known company portal
• Sign-in flows that feel slightly off, since a relayed login through a proxy can behave differently from a normal Microsoft sign-in

Defenders can also look for known technical tells associated with these pages: login pages almost always load the paired assets barr.svg and lg.svg, then POST stolen credentials to endpoints like next.php or save.php.

How to build resistance

Organizations should treat any W-2 or payroll-themed message pushing a QR code or login as high risk and encourage verification with HR or payroll before acting. Because a stolen session can survive a password reset, incident response for suspected credential theft should include revoking active sessions, not just changing passwords. Security teams benefit from actively hunting for the identified asset names and collection endpoints to spot and shut down lookalike Microsoft 365 pages faster, complementing user awareness with technical detection tied to techniques like T1566.002 (spearphishing via attachment/QR-style lures) and T1656 (impersonation).

How did the Kratos phishing kit trick victims?

Operators sent tax-themed emails carrying a W-2 document with a QR code personalized to the recipient, which led to a fake Microsoft 365 login page.

Can this attack bypass multi-factor authentication?

Yes. The kit used a Node.js reverse proxy to relay the login to Microsoft in real time and capture the resulting session cookie, which is enough to walk past two-factor authentication into the account as the user.

Is resetting a password enough after this kind of phishing?

No. Because the stolen session can survive a password reset, the session itself has to be revoked, not just the password changed.

What technical indicators point to a Kratos-style phishing page?

Analysts found that these login pages almost always load the paired assets barr.svg and lg.svg, then POST stolen credentials to endpoints like next.php or save.php.