A sophisticated phishing-as-a-service (PhaaS) platform dubbed “Morphing Meerkat” has been operating largely undetected since 2020, using advanced DNS techniques to evade security measures. Recently uncovered by Infoblox researchers, this operation provides cybercriminals with comprehensive tools to launch effective phishing campaigns requiring minimal technical expertise.
## Advanced Evasion Techniques
What sets Morphing Meerkat apart is its use of DNS over HTTPS (DoH) protocol and DNS Mail Exchange (MX) records to dynamically identify victims’ email providers. This allows the platform to serve tailored, spoofed login pages for over 114 brands including Gmail, Outlook, Yahoo, DHL, Maersk, and RakBank.
The attack process begins when victims click malicious links in spam emails. The phishing kit then queries the victim’s email domain MX record using DoH via Google or Cloudflare. Based on this information, it automatically loads the appropriate fake login page with the victim’s email address pre-filled.
## Comprehensive Phishing Infrastructure
Morphing Meerkat provides a centralized SMTP infrastructure for distributing spam emails, with 50% of traced messages originating from UK-based iomart and US-based HostPapa internet services. The platform can:
– Impersonate over 114 email and service providers
– Deliver messages in multiple languages including English, Spanish, Russian, and Chinese
– Spoof sender names and addresses
– Create urgent subject lines like “Action Required: Account Deactivation”
## Sophisticated Attack Chain
When victims click malicious links, they’re directed through a chain of open redirect exploits on ad tech platforms like Google DoubleClick, often involving compromised WordPress sites, fake domains, and free hosting services.
After credentials are entered, they’re exfiltrated to attackers via AJAX requests and PHP scripts. The system even employs a clever verification technique—displaying an “Invalid Password” error to trick victims into re-entering credentials, confirming their accuracy before redirecting to legitimate authentication pages to avoid suspicion.
## Recommended Defenses
Security experts recommend implementing tighter DNS controls to prevent users from communicating with DoH servers and blocking access to non-essential adtech and file-sharing infrastructure.
Complete indicators of compromise (IoC) associated with Morphing Meerkat activity are available on GitHub for organizations looking to protect themselves against this threat.