How can a DNS mail record be used to trick you into giving up your login credentials?

Researchers at Infoblox have identified a phishing-as-a-service (PhaaS) platform called Morphing Meerkat that’s been quietly operating for over five years. What makes it notable is its use of DNS MX (Mail Exchange) records in ways rarely reported before. Instead of the usual static phishing page setups, Morphing Meerkat queries the victim’s email provider’s MX record—using DNS-over-HTTPS via Google or Cloudflare—to tailor the phishing page dynamically. This means victims are shown spoofed login interfaces that mimic the exact service they use, complete with matching branding and pre-filled email fields.

The platform supports more than 114 brand templates and uses obfuscated JavaScript to evade detection. It also includes built-in translation capabilities based on browser profile or geolocation, making the fake login pages appear native to the user's language. Earlier versions began in 2020 targeting just five email services (Gmail, Outlook, Yahoo, AOL, Office 365). By mid-2023, they could generate phishing pages dynamically using MX records and now operate in over a dozen languages.

Morphing Meerkat campaigns rely on a set of centralized email servers, primarily hosted by UK ISP iomart and US-based HostPapa, indicating a coordinated infrastructure rather than a loose network of attackers. The phishing emails often impersonate trusted services—banks, shipping companies, etc.—and are distributed using compromised WordPress sites, open redirects from platforms like Google’s DoubleClick, and embedded links in shortened URLs.

Once a user submits credentials, the system may display a fake “Invalid Password” error to lure them into re-entering data, after which they are redirected to the real login page. This not only reduces suspicion but also increases the chance of capturing correct credentials. Stolen data is sent back via AJAX, PHP scripts, or Telegram bots, sometimes with evidence removed in real-time.

This operation shows a deep understanding of modern security blind spots—including how content delivery and DNS infrastructure can be turned against end users.

#Infosec #Cybersecurity #Software #Technology #News #CTF #Cybersecuritycareer #hacking #redteam #blueteam #purpleteam #tips #opensource #cloudsecurity

—
P.S. Found this helpful? Tap Follow for more cybersecurity tips and insights! I share weekly content for professionals and people who want to get into cyber. Happy hacking

Hey, I know some of those people! The Franklin project is kicking off. Godspeed.

https://www.theregister.com/2024/11/24/water_defcon_hacker/

Next time a dev lead tells me they can't debug that DOM Insecure Redirect, I'll point out that AT LEAST IT ISN'T FIFTEEN BILLION MILES AWAY

https://www.theverge.com/2024/6/15/24179265/voyager-1-functioning-again-nasa-deep-space

BSides St. Pete is happening this weekend, and if you’re into (or want to get into) cybersecurity, you’ll want to catch it! Find out more here...

#Tampa #TampaBay #StPete #StPetersburg #StPeteresburgFL #conferences #security #cyber #cybersecurity #BSides #RedTeam #BlueTeam #PurpleTeam

https://www.globalnerdy.com/2023/09/12/bsides-st-pete-it-security-conference-saturday-september-16/

I finally finished another blog post! It's called "Monitoring Command Execution In Containers With Sysdig".

It's kinda purple-teamy? I go through setting up Sysdig, building a vulnerable Docker image, and then attacking it. Then we look at how we can detect the attack with Sysdig.

https://keefer.io/posts/sysdig-monitoring/

My team just released a new MFA bombing testing tool. It can be used in purple & red team modes to execute MFA fatigue/spamming/bombing on #Okta users. After we'll add more IdPs
AFAIK it is the first MFA bombing tool for Okta.

github.com/authomize/mfa-…

#introduction

Hi,

I am an #infosec enthusiast interested in #dfir #incidentresponse #malware #rootkits #velociraptor #reversing and a bit #pentesting / #purpleteam (yeah, bit more on the #blueteam side... )

Programming wise #linux #python #rust #golang

Apart from that I can always talk about #rock and #metal

Looking forward to connect to people on these topics - feel free to PM me

#Next Week

I will be Purple teaming with a new vendor this time. I and my team will be #defense while the vendors act as the attackers.

I obviously cannot say who the #vendors are, but I am super pumped for it to be them.

Any tooting I might do throughout next week will be intentionally vague because everything we do where I work is proprietary so I cannot reveal some details.

I will be trying to live toot things like the score ​

New server, new #introduction Now with a luxurious amount of characters available to me I believe #privacy is a human right & I focus on helping people & SMBs who have elevated risk of #surveillance harassment & violence because of who they are or what they do. I help & teach--never shame--people for not knowing something or not having had the time or bandwidth to implement things on their own. I do #InfoSec #OSINT #PurpleTeam #ThreatAwareness #virtualization My work means I spend a lot of time thinking about far right extremism, ethical AI, data science, security, journalism, & politics. I find myself fighting with #libvirt a lot If that means anything to you, please feel free to tell me where to find helpful and up to date references for it and/or #KVM aside from their man pages

I'm still recovering from my years as the head of #photography for an academic museum. I took took down my portfolio site a few years ago. But I like talking about photography and I really am happy to help with photo related questons when I can! Mentoring is one of the only things I miss about that job. I might start rebuilding my site & I may post some of my photos here. Cat photos, however, will definitely be posted ​

My current side/hobby projects are: an energy efficient network & #homelab upgrade, then designing PCBs for a split ortho #keyboard that will perfectly fit my hands bc I have RSI and switching to one made a world of difference. After which I'm going to try to restore/replace the bellows of a vintage accordion. I do #lockpicking for relaxation. #Music is life for me and I'm always making or tweaking a playlist. Like Erick Sermon said, "I wish music could adopt me."

I give random compliments because kindness. I like to be helpful and connecting good people with other good people is one of my favorite things to do. My values: antiracism, disability justice, intersectionality, actively fighting against: bigotry, sexism, homophobia, transphobia, fatphobia, colonialism, classism, elitism. Billionaires shouldn't exist and antifascism should be the default. These values guide my work & personal life.