New Phishing Service Exposed

Attack Overview

Security experts have recently uncovered a new phishing tool available for hire. This service uses DNS mail exchange (MX) records to deliver fake login pages that mimic more than 100 popular brands.

You might be interested in:

The group behind this scam, nicknamed “Morphing Meerkat” by cybersecurity firm Infoblox, takes advantage of open redirects on ad platforms and compromised websites. Phishing emails, often disguised as links to shared documents, instead lead users to counterfeit login pages hosted on services like Cloudflare R2. The main aim is to capture login details and send them over messaging apps such as Telegram.

Global Reach and Tactics

Morphing Meerkat has reportedly sent thousands of spam emails using hacked WordPress sites and vulnerabilities in advertising networks like Google-owned DoubleClick. The phishing pages are designed to automatically switch between over a dozen languages—including English, Korean, Spanish, Russian, German, Chinese, and Japanese—to better deceive users worldwide.

A unique aspect of this phishing kit is its use of DNS MX records from providers like Cloudflare and Google. By identifying the victim’s email service (such as Gmail, Outlook, or Yahoo!), the tool displays a fake login page that closely resembles the authentic one. If it cannot determine the email provider, it falls back to a generic Roundcube login page.

Built-In Evasion Techniques

To hinder analysis and prevention, the fake pages are deliberately complicated with techniques that hide their true code. They also disable common browser actions like right-clicking and shortcuts (Ctrl + S and Ctrl + U), making it harder for users or researchers to view or save the underlying page source.

Final Thoughts

This phishing-as-a-service tool is particularly dangerous because it tailors its approach to the victim, creating a realistic experience that increases the chance of stealing credentials. By matching the design of the phishing email with a convincing login page, the attackers boost their likelihood of success.