Thekabarnews.com—Indonesia’s National Police have arrested the alleged developer of Kratos, a global phishing-as-a-service (PhaaS/Kratos) platform. This platform reportedly helped cybercriminals steal account credentials and bypass common security protections.

The Directorate of Cybercrime of the National Police (Dittipidsiber Bareskrim Polri) arrested a 25-year-old suspect identified by the initials MI in Pontianak, West Kalimantan, on July 11.

Police suspect MI developed, managed and sold the Kratos phishing toolkit while providing technical support to customers. Investigators said buyers paid for access using cryptocurrency.

Dittipidsiber Bareskrim Polri Director Brig. Gen. Pol. Adex Yudiswan said investigators found Kratos while expanding their investigation into W3LL Store, another international marketplace that distributed phishing tools.

“From the development of the W3LL Store case, investigators discovered another platform that provided phishing tools. They examined the finding further, leading them to Kratos and its developer in Indonesia,” Adex said on July 24.

Investigators conducted cyber surveillance, tested the tools with information technology experts and traced digital infrastructure, cryptocurrency transactions and financial flows. The evidence eventually led police to MI in Pontianak.

Dittipidsiber Bareskrim Polri previously arrested two suspects in the W3LL Store investigation in Kupang, East Nusa Tenggara, in April 2026.

Police said the earlier operation generated an estimated Rp25 billion in proceeds between 2021 and 2026. The FBI described W3LL as a full-service cybercrime platform linked to more than 17,000 potential victims worldwide.

Phishing-as-a-Service (PhaaS/Kratos) allows customers to rent ready-made tools for creating fraudulent websites and stealing login credentials. These tools let users create fraudulent websites without developing the technology themselves.

Kratos reportedly enabled users to build convincing fake Microsoft authentication pages.

The platform could capture email addresses, passwords and active session data. This potentially allows attackers to bypass some forms of multifactor authentication.

Germany’s Federal Criminal Police Office said more than 1,800 suspected criminal customers acquired Kratos. They used it to run about 15,000 phishing campaigns per month.

International investigators disabled more than 200 servers, bringing the platform’s central infrastructure offline.

German authorities also identified about 850 victims across 35 countries, primarily in Europe and the United States.

They estimated that Kratos generated more than €300,000 through subscriptions paid in cryptocurrency since 2024.

Dittipidsiber Bareskrim Polri continues to trace suspected buyers and users. They also identify additional victims and investigate cryptocurrency holdings and other infrastructure linked to Kratos.

“Our target is not just to arrest one perpetrator, but to dismantle the ecosystem that allows these tools to be developed, traded and used to attack victims,” Adex said.

Police have charged MI under Indonesia’s Electronic Information and Transactions Law and provisions of the new Criminal Code related to money laundering.

The allegations remain subject to investigation and court proceedings, and the suspect retains the presumption of innocence until proven guilty.