Infoblox Threat Intel
Morphing Meerkat
Morphing Meerkat runs a sophisticated phishing-as-a-service (PhaaS) operation that has been active since at least 2020. It leverages DNS-over-HTTPS (DoH) and MX record queries to dynamically identify a victim’s email provider and serve targeted phishing pages. The platform supports over 114 brand-specific templates and offers automatic language translation to localize attacks.
Morphing Meerkat employs cloaking techniques to evade detection by redirecting suspicious traffic to legitimate sites. It often delivers phishing via compromised WordPress sites or open redirect links. Stolen credentials are exfiltrated in real time via email or messaging apps. Its use of DNS-layer obfuscation and modular design makes the PhaaS tool both stealthy and scalable.
Morphing Meerkat
- Operating since: January 2020
- Infoblox discovered: February 2025
- Infoblox published: March 2025
- Prevalence: Uncommon
