Phishing-as-a-service operation uses DNS-over-HTTPS for evasion

Infoblox researchers uncovered 'Morphing Meerkat', a phishing-as-a-service operation active since at least 2020 that uses DNS-over-HTTPS and MX record lookups to dynamically identify victims' email providers and present tailored spoofed login pages for more than 114 brands; the operation employs centralized SMTP infrastructure, open-redirect chains and compromised sites to deliver multilingual phishing, exfiltrates credentials via AJAX/PHP and optional Telegram webhooks, and has associated IoCs published on GitHub.