New Morphing Meerkat Phishing Kit Exploits DNS to Spoof 100+ Brands

Infoblox researchers describe "Morphing Meerkat," a sophisticated phishing-as-a-service operation that has abused DNS MX records, DNS-over-HTTPS (DoH), open redirects on adtech platforms, and compromised WordPress sites to dynamically serve over 114 brand-specific fake login pages and harvest credentials via EmailJS, PHP/AJAX, and Telegram hooks. The platform centralizes spam distribution through specific hosting providers, implements cloaking and anti-analysis techniques, supports multi-language translation, and has evolved since 2020 to increase its reach and evasion — prompting recommendations to tighten DNS security, restrict DoH, and limit access to non-essential infrastructure.