ANY.RUN reverse-engineered the Kratos phishing kit, identifying key indicators such as the paired assets barr.svg and lg.svg on login pages, and POST requests to endpoints like next.php or save.php. The firm rates these indicators at 90% recall with near-zero false positives.