This new phishing campaign can tailor its messages to target you with your favorite businesses
Morphing Meerkat has been flying under the radar for years, experts warn

- Morphing Meerkat phishing kit can spoof more than 100 different brands
- It's been used to send "thousands" of emails, experts warn
- Defenses includes adding a strong layer of DNS security
Cybercriminals have created a new technique to serve phishing emails to business users which are almost indistinguishable from legitimate messages.
Cybersecurity researchers Infoblox spotted the Phishing-as-a-Service (PhaaS) kit, built by a threat actor dubbed Morphing Meerkat, which deploys DNS Mail exchange (MX) records, dynamically serving fake login pages.
The technique allows them to spoof more than 100 different brands, making it quite a potent offering for cybercriminals.
Monitor your credit score with TransUnion starting at $29.95/month
TransUnion is a credit monitoring service that helps you stay on top of your financial health. With real-time alerts, credit score tracking, and identity theft protection, it ensures you never miss important changes. You'll benefit from a customizable online interface with clear insights into your credit profile. Businesses also benefit from TransUnion’s advanced risk assessment tools.
Preferred partner (What does this mean?)
Open redirects
“Morphing Meerkat’s PhaaS platform and phishing kits are unique compared to others because they dynamically serve phishing login webpages based on the DNS MX record of each victim’s email domain,” the researchers explained, saying that it lets the attackers display web content “strongly related” to the victim’s email service provider.
“The overall phishing experience feels natural because the design of the landing page is consistent with the spam email’s message,” they added.
Morphing Meerkat hasn’t exactly drawn much attention to itself yet, which might sound rather surprising given the fact that it sent “thousands” of spam emails from servers mostly located in the UK and the United States.
However, the researchers said the operation is “difficult” to detect at scale, since the attackers know where security blind spots are, and have been exploiting them via open redirects on adtech, DoH communication, and popular file-sharing services.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
To protect themselves, organizations should add a strong layer of DNS security to their systems, Infoblox concludes, which includes tightening DNS controls and not allowing users to communicate with DoH servers.
“If companies can reduce the number of unimportant services in their network, they can reduce their attack surface, giving few options to cybercriminals for threat delivery,” Infoblox concluded.
You might also like
- Massive online data breach sees 2.7 billion records leaked - here's what we know
- We've rounded up the best password managers
- Take a look at our guide to the best authenticator app
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
You must confirm your public display name before commenting
Please logout and then login again, you will then be prompted to enter your display name.