- Morphing meerkat phishing kit can forgery more than 100 different brands
- It has been used to send “thousands” of e -emails, experts warn
- Defense includes the addition of a strong layer of DNS security
Cyber criminals have created a new technique to serve phishing -e emails to business users who can hardly be distinguished from legitimate messages.
CyberSecurity scientists InfoBlox discovered the phishing-as-a-service (Phaas) set, built by a threat actor called Morphing Meerkat emitting DNS Mail Exchange (MX) records that dynamically serve fake login pages.
The technique allows them to be falsified more than 100 different brands, making it quite a potent offer to cyber criminals.
Open Redirigations
“Morphing Meerkats Phaas -Platform and Phishing -Set are unique compared to others because they dynamic serve phishing -login -websides based on the DNS MX post for each victim’s e -mail domain,” the researchers explained, saying it lets the striker show the web content “strongly related” to the victim’s e -mail service provider.
“The overall phishing experience feels natural because the design of the destination page is in line with the SPAM -E -mail message,” they added.
Morphing Meerkat has not exactly drawn much attention to itself yet, which may sound rather surprising considering the fact that it sent “thousands” of spam -e emails from servers mostly located in England and the United States.
However, the researchers said the operation is “difficult” to detect on scale, as attackers know how safety-blind spots are and have utilized them through open redirections of adtech, doh communication and popular file sharing services.
To protect themselves, organizations need to add a strong layer of DNS security to their systems, concludes InfoBlox, which includes tightening DNS controls and does not allow users to communicate with Doh servers.
“If companies can reduce the number of immaterial services in their networks, they can reduce their attacking surface, providing few opportunities for cyber criminals for pacifiers,” concluded InfoBlox.
