The Rise Of Kratos: How The New Phishing-As-A-Service Kit Industrializes Cybercrime
KnowBe4, Friday, February 27th, 2026
By the end of 2026, over 90% of all credential compromise attacks are estimated to be enabled by modular Phishing-as-a-Service (PhaaS) kits like the sophisticated, global threat, Kratos.
This aggressive platform has already begun reshaping the threat landscape. At its core, Phishing-as-a-Service (PhaaS) is a malicious cloud-based service that allows easier deployment of phishing attacks and faster updating of features as compared to traditional phishing and malware attacks.
KnowBe4 Threat Labs identified and launched a thorough investigation into Kratos PhaaS shortly after its first observation around the beginning of 2026. This investigation has provided a rare 'under-the-hood' look at the platform, allowing our analysts to deobfuscate the codebase and map its sophisticated operational logic.