Authorities Dismantle Kratos Phishing Network; Novel Malware Uses Microsoft 365 Calendars for C2

Law enforcement agencies in Germany and the U.S. have successfully dismantled the Kratos phishing-as-a-service (PhaaS) platform as part of "Operation Olympus Blade." The operation resulted in the seizure of over 200 servers, effectively shutting down Kratos's global infrastructure, and the apprehension of its suspected developer in Indonesia. Investigators estimate that Kratos, which operated as a franchise since late 2024, was utilized by more than 1800 cybercriminals to launch approximately 15,000 phishing campaigns monthly, generating at least €300,000 in subscription fees.

The Kratos platform provided threat actors with sophisticated toolkits designed to create convincing fake Microsoft authentication pages. These campaigns primarily targeted victims in the United States and Europe, facilitating widespread credential theft and unauthorized account access. A key feature of the Kratos toolkit was its adversary-in-the-middle (AitM) capability, which employed a Node.js reverse proxy to intercept active session cookies in real-time. This advanced functionality allowed attackers to bypass multi-factor authentication (MFA) controls, granting them initial access for business email compromise (BEC), data theft, and further phishing attacks. Notably, a campaign in February used tax-themed lures and personalized QR codes to target dozens of American manufacturing and healthcare organizations.

Despite the infrastructure takedown, officials caution that the underlying toolkit code remains accessible to Kratos's existing customer base. This means that operators who possess copies of the kit can potentially resume their malicious activities under new branding with minimal effort, posing an ongoing threat. The dismantling of Kratos represents a significant blow to the phishing-as-a-service ecosystem, but the persistence of the toolkit itself highlights the challenges in eradicating such operations.

In parallel, a novel espionage implant named HollowGraph has emerged, employing a stealthy method to establish covert command and control (C2) channels by leveraging Microsoft 365 calendars. This .NET DLL implant operates without direct communication with attacker-controlled servers, instead routing instructions and exfiltrated data through legitimate Microsoft Graph API traffic. This technique allows HollowGraph's activities to blend seamlessly with normal network operations, making detection exceptionally difficult.

HollowGraph queries a compromised user's calendar for a specific event scheduled far into the future—in this case, May 13, 2050. Operator instructions are embedded within text files attached to this anomalous event, ensuring they remain undiscovered as users rarely check calendars so far ahead. For data exfiltration, the malware encrypts stolen files using a hybrid RSA and AES-256 encryption scheme, creates a new future-dated calendar event, and uploads the encrypted data as attachments. To maintain continuous access to the Graph API, attackers use a secondary DNS-based channel to refresh the application's Entra ID login credentials, which are stored in a disguised configuration file.

Researchers observed HollowGraph actively compromising machines at an Israeli organization between June and July 2026. While the implant's code shares similarities with the Cavern backdoor framework, often used by Iranian state-sponsored groups, a definitive attribution to a specific threat group has not yet been made. The reliance on compromised account identities and legitimate application permissions, rather than exploiting software vulnerabilities, renders traditional patching ineffective against HollowGraph. This method weaponizes the trust organizations place in their own Microsoft Graph API traffic, turning routine calendar activity into a critical blind spot.

The broader implications of these developments underscore the evolving tactics of cybercriminals. The disruption of a major PhaaS platform like Kratos is a positive step, but the continued availability of its tools means the threat landscape remains dynamic. Simultaneously, the emergence of sophisticated implants like HollowGraph, which exploit trusted cloud services for covert operations, highlights the increasing sophistication and stealth employed by threat actors. Organizations must remain vigilant, adapting their security strategies to counter these advanced and evasive techniques.