Kratos PhaaS, Multi-Stage Redirect Chains & Festival Ticket Fraud: OTX Pulse Analysis — M365 Credential Theft Detection Pack | Security Arsenal

Three concurrent OTX pulses published today reveal a coordinated surge in credential-harvesting infrastructure aimed squarely at Microsoft 365 tenants, payment data, and consumer identities across the United States and Europe. While the campaigns differ in target audience, they share a common operational backbone: abuse of trusted cloud platforms, multi-stage redirection, and polished brand impersonation to defeat both users and email security gateways.

Threat Summary

The three pulses describe distinct but technique-overlapping operations:

Kratos PhaaS (Phishing-as-a-Service) — A mature, commercialized phishing platform targeting Microsoft 365 users across the US and 10 European countries. Researchers traced three generations of the kit and uncovered 1,484 previously unattributed detonations, meaning a large volume of existing sandbox submissions was quietly linked to this single operation. Kratos leverages trusted-platform hosting, anti-bot verification gates, and pixel-perfect M365 login clones to enable downstream account takeover (ATO).
Multi-Stage Phishing Redirection Chains — LevelBlue SpiderLabs documented campaigns abusing Framer (no-code web platform) and Cloudflare Workers to host deceptive landing pages. These chains use HTML redirection smuggling via the Blob API and the Web Crypto API for client-side decryption, ensuring the malicious payload is assembled in-browser and never traverses the wire in scannable form. The chains terminate in brand-impersonation credential harvesters hosted on newly registered domains, with some lures leveraging device code phishing against OAuth flows.
Tomorrowland 2026 Fake Ticket Scams — Approximately a dozen fraudulent domains impersonate the sold-out Belgian festival, using countdown timers, fake biometric verification, and cloned checkout flows to steal payment card data and personal identity information from victims in Belgium, Czechia, France, and Sweden. Some infrastructure (e.g., mcsdirect.tech, festreisen.com) suggests a travel/fraud backend reusable across event-themed campaigns.

Collective objective: bulk credential and payment-data harvesting for resale and initial access. Kratos-collected M365 credentials feed business email compromise (BEC), internal phishing pivots, and dark web credential markets; the festival scam infrastructure monetizes card-not-present fraud directly.

Threat Actor / Malware Profile

No single named actor is attributed across these pulses, but the Kratos operation exhibits the hallmarks of a professionally run PhaaS vendor selling subscriptions to multiple downstream criminal customers:

Distribution method: Phishing emails and malvertising lures pointing to redirect chains. Kratos distributes via phishing pages hosted on compromised or bulletproof German-hosted domains (.de TLD cluster: buenne.de, ihrsupportcenter.de, rundwasser.de), while the redirect-chain campaigns ride legitimate SaaS (Framer sites, Cloudflare Workers subdomains) to inherit trusted TLS certificates and reputation.
Payload behavior: No traditional binary payload — the "malware" is the phishing page itself. The Web Crypto API decrypts page content client-side; the Blob API (URL.createObjectURL) smuggles the final credential-harvesting HTML, bypassing static URL scanners. Kratos pages proxy or clone the live M365 login flow, capturing credentials (and in device-code variants, OAuth tokens) in real time.
C2 / exfiltration communication: Stolen credentials are POSTed to attacker-controlled endpoints such as dwbud.vilaribit.com, abal.my, starwellmedia.com, and path-heavy URLs on bl.dase7.shop and alasilla.com. High-entropy, machine-generated path strings (e.g., the 200+ character numeric token path on dase7.shop) are a reliable network signature.
Persistence mechanism: Account-level persistence rather than endpoint persistence — captured credentials enable direct logins, OAuth consent grants, and device code session tokens that survive password changes if refresh tokens were captured. Expect follow-on mailbox rules and MFA fatigue/prompt bombing during ATO.
Anti-analysis techniques: Anti-bot verification (CAPTCHA/JS challenges) gates the phishing page against sandboxes; client-side decryption defeats network-layer inspection; newly registered domains and disposable Workers subdomains churn faster than blocklists update. The 1,484 unattributed detonations prove sandbox evasion is working at scale.

IOC Analysis

The pulses contain domains, hostnames, and URLs — no IPs or file hashes — consistent with web-only phishing infrastructure. Operationalize as follows:

Domain/hostname indicators (buenne.de, enerdizerandtron.de, ihrsupportcenter.de, rundwasser.de, sonnenbrillenspot.de, dwbud.vilaribit.com, abal.my, starwellmedia.com, 2934523t5234535323973294afhdsfga.com, alasilla.com, bl.dase7.shop, plus the eight Tomorrowland fraud domains): block at DNS resolver, secure web gateway, and email gateway URL-rewrite layers. Note the .de cluster likely resolves through a small set of bulletproof hosting ASNs — pivot on passive DNS to identify sibling Kratos panels.
Full-URL indicators (the dase7.shop and alasilla.com paths): deploy as exact-match URL blocks and as regex signatures — the pattern of long numeric/hex path segments on low-reputation TLDs (.shop, .tech, .info) is itself detectable.
Typosquat detection: belgium-tomorrowlland.com, belgiumtomoorrowland.com, jedemenatomorrowland.cz, and tmrlnd.shop show deliberate misspelling (double-L, double-O) and brand-substring stuffing. Feed these into a brand-monitoring fuzzy matcher (e.g., dnstwist-style permutations) to preemptively catch the next registration wave.
Tooling: normalize and decode indicators with CyberChef (URL/defang operations), enrich via OTX, VirusTotal, and URLScan.io, and detonate suspect pages in an interactive sandbox such as ANY.RUN to extract the final-stage credential POST destination. Any.run's trace of Kratos generations is the reference detonation set for this kit.

Detection Engineering

YAML

---
title: Kratos PhaaS Credential Harvester Domain Resolution
id: 9f1e2c3a-7b4d-4e5f-9a01-kratosphaas001
status: experimental
description: Detects DNS resolution of known Kratos PhaaS phishing panel domains and multi-stage redirect chain infrastructure from OTX pulses dated 2026-08-13
author: Security Arsenal Threat Intel
date: 2026/08/13
references:
  - https://any.run/cybersecurity-blog/kratos-phaas-account-takeover/
  - https://www.levelblue.com/blogs/spiderlabs-blog/the-infrastructure-relay-inside-multi-stage-phishing-redirection-chains
logsource:
  category: dns
detection:
  selection_domain:
    query|contains:
      - 'buenne.de'
      - 'enerdizerandtron.de'
      - 'ihrsupportcenter.de'
      - 'rundwasser.de'
      - 'sonnenbrillenspot.de'
      - 'vilaribit.com'
      - 'abal.my'
      - 'starwellmedia.com'
      - 'dase7.shop'
      - 'alasilla.com'
      - '2934523t5234535323973294afhdsfga.com'
  condition: selection_domain
falsepositives:
  - Threat research and sandbox detonation environments
level: high
tags:
  - attack.t1566.002
  - attack.t1071.001
---
title: HTML Smuggling via Blob API and Web Crypto Decryption in Browser
id: 8d2f4a6b-1c3e-4d5f-8b02-htmlsmuggle002
status: experimental
description: Detects browser processes creating script files followed by Office or credential-page artifacts, consistent with Blob API HTML smuggling and Web Crypto client-side decryption used in multi-stage phishing chains
author: Security Arsenal Threat Intel
date: 2026/08/13
logsource:
  category: file_event
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_path:
    TargetFilename|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
    TargetFilename|endswith:
      - '.html'
      - '.htm'
      - '.js'
  filter_known:
    TargetFilename|contains:
      - '\Microsoft\Edge\User Data\'
      - '\Mozilla\Firefox\Profiles\'
      - 'favicon'
  condition: selection_browser and selection_path and not filter_known
falsepositives:
  - Legitimate user downloads of HTML reports or exports
level: medium
tags:
  - attack.t1027
  - attack.t1204.002
  - attack.t1059.007
---
title: OAuth Device Code Flow Authentication Followed by Anomalous Token Use
id: 7c1a3b5d-2e4f-4a6b-7c03-devicecode003
status: experimental
description: Detects device code authentication flows against Microsoft 365 followed by token usage, a technique abused in phishing chains to capture OAuth sessions without stealing passwords
author: Security Arsenal Threat Intel
date: 2026/08/13
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    authentication_protocol|contains: 'deviceCode'
    status: success
  condition: selection
falsepositives:
  - Legitimate device code sign-ins for CLI tools (Azure CLI, Teams on shared devices) - baseline and exclude known service principals and managed devices
level: high
tags:
  - attack.t1528
  - attack.t1550
  - attack.t1078

KQL — Microsoft Sentinel / Defender

// Hunt: Phishing infrastructure access + device code ATO behavior
// Lookback: 14 days | Tables: DeviceNetworkEvents, DeviceProcessEvents, SigninLogs

let PhishDomains = dynamic([
  "buenne.de","enerdizerandtron.de","ihrsupportcenter.de","rundwasser.de",
  "sonnenbrillenspot.de","vilaribit.com","abal.my","starwellmedia.com",
  "dase7.shop","alasilla.com","2934523t5234535323973294afhdsfga.com",
  "tomorrowland-booking.com","belgium-tomorrowlland.com","belgium-tomorrowlland.info",
  "belgiumtomoorrowland.com","festreisen.com","jedemenatomorrowland.cz",
  "mcsdirect.tech","tmrlnd.shop"
]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (PhishDomains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
          InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType;
let BrowserToOfficeChain = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("chrome.exe","msedge.exe","firefox.exe")
| where FileName in~ ("mshta.exe","rundll32.exe","powershell.exe","wscript.exe","cmd.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
let DeviceCodeSignins = SigninLogs
| where TimeGenerated > ago(14d)
| where AuthenticationProtocol has "deviceCode" or AuthenticationRequirement == "singleFactorAuthentication"
| where ResultType == 0
| where IPAddress !in (dynamic([]))  // add known corporate egress IPs to suppress
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName,
          AuthenticationProtocol, Location, UserAgent;
union NetworkHits, BrowserToOfficeChain, DeviceCodeSignins
| sort by TimeGenerated desc

PowerShell

# IOC Hunt: Kratos PhaaS + redirect-chain + ticket-fraud infrastructure
# Run via RMM/Intune across endpoints; outputs CSV of hits per host
$PhishIndicators = @(
  'buenne.de','enerdizerandtron.de','ihrsupportcenter.de','rundwasser.de',
  'sonnenbrillenspot.de','vilaribit.com','abal.my','starwellmedia.com',
  'dase7.shop','alasilla.com','2934523t5234535323973294afhdsfga.com',
  'tomorrowland-booking.com','belgium-tomorrowlland.com','belgium-tomorrowlland.info',
  'belgiumtomoorrowland.com','festreisen.com','jedemenatomorrowland.cz',
  'mcsdirect.tech','tmrlnd.shop'
)
$results = @()

# 1. DNS client cache (indicates a resolution occurred on this host)
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($ioc in $PhishIndicators) {
  $hits = $dnsCache | Where-Object { $_.Entry -like "*$ioc*" }
  foreach ($h in $hits) {
    $results += [PSCustomObject]@{Host=$env:COMPUTERNAME; Source='DNSCache'; IOC=$ioc; Evidence=$h.Entry; Detail=$h.Data}
  }
}

# 2. Browser history artifacts (Edge/Chrome SQLite presence check via URL string match)
$histPaths = @(
  "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History",
  "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History"
)
foreach ($p in $histPaths) {
  if (Test-Path $p) {
    $tmp = "$env:TEMP\hist_copy_$(Get-Random).db"
    Copy-Item $p $tmp -Force -ErrorAction SilentlyContinue
    $raw = [System.IO.File]::ReadAllBytes($tmp)
    $txt = [System.Text.Encoding]::ASCII.GetString($raw)
    foreach ($ioc in $PhishIndicators) {
      if ($txt -match [regex]::Escape($ioc)) {
        $results += [PSCustomObject]@{Host=$env:COMPUTERNAME; Source='BrowserHistory'; IOC=$ioc; Evidence=$p; Detail='IOC string present in history DB'}
      }
    }
    Remove-Item $tmp -Force -ErrorAction SilentlyContinue
  }
}

# 3. Recently created HTML/JS files in user-writable dirs (HTML smuggling artifacts)
$smuggle = Get-ChildItem "$env:USERPROFILE\Downloads","$env:TEMP" -Recurse -Include *.html,*.htm,*.js -ErrorAction SilentlyContinue |
  Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-14) -and $_.Length -gt 10KB }
foreach ($f in $smuggle) {
  $content = Get-Content $f.FullName -Raw -ErrorAction SilentlyContinue
  if ($content -match 'createObjectURL|atob\(|crypto\.subtle|Blob\(') {
    $results += [PSCustomObject]@{Host=$env:COMPUTERNAME; Source='HTMLSmuggle'; IOC=$f.FullName; Evidence=$f.CreationTime; Detail='Blob/WebCrypto pattern detected'}
  }
}

# 4. Suspicious mailbox forwarding rules evidence: recent Outlook rule files
$rules = Get-ChildItem "$env:APPDATA\Microsoft\Outlook" -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) }
foreach ($r in $rules) {
  $results += [PSCustomObject]@{Host=$env:COMPUTERNAME; Source='OutlookProfile'; IOC=$r.FullName; Evidence=$r.LastWriteTime; Detail='Review for malicious inbox rules post-ATO'}
}

$results | Export-Csv ".\phish_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
$results | Format-Table -AutoSize

Response Priorities

Immediate (0-4 hours):

Push all 30+ domains/hostnames from the three pulses to DNS sinkhole, secure web gateway, and email gateway URL-rewrite blocklists. Block the .shop/.tech/.info high-entropy URL path regex at the proxy.
Execute the KQL hunt and PowerShell sweep across the fleet; any host with a DNS cache or history hit for a Kratos panel domain is a confirmed credential exposure until proven otherwise.
Alert help desk and SOC to expect ATO symptoms: MFA prompt bombing, impossible-travel sign-ins, and new inbox rules.

Within 24 hours:

For every user whose endpoint touched a phishing domain: force password reset, revoke all refresh tokens and active sessions (Revoke-MgUserSignInSession), and audit Azure AD sign-in logs for the preceding 14 days for device code flows and unfamiliar OAuth consents.
Review Exchange transport rules and per-mailbox forwarding for persistence artifacts; Kratos ATO frequently plants auto-forward rules before monetization.
For users who visited festival-scam domains on corporate assets or with corporate cards: trigger card reissue and monitor for card-not-present fraud.

Within 1 week:

Deploy FIDO2/phishing-resistant MFA for privileged and finance users — Kratos defeats SMS and push-based MFA via real-time proxying, and device code phishing defeats password-centric controls entirely.
Restrict the OAuth device code flow via Conditional Access to compliant devices only; block end-user consent to unverified third-party apps.
Enable browser-level protections: block blob: navigation to credential pages where the EDR/browser isolation supports it, and stand up dnstwist-style brand monitoring for your own domains plus event/partner brands your users engage with.
Brief staff in Hospitality/Entertainment-adjacent units on event-themed fraud, since ticket and travel scams recycle infrastructure across festivals.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Kratos PhaaS, Multi-Stage Redirect Chains & Festival Ticket Fraud: OTX Pulse Analysis — M365 Credential Theft Detection Pack