IN THE NEWS

Phishers, ransomware groups, and state-sponsored actors are using a decades-old domain name system (DNS) abuse technique to supercharge their malicious infrastructure.

This story, originally published March 29, has been updated with further Medusa mitigation advice from the FBI as well as additional comment from Boris Cipot, and a report into another “as a service” threat, this time from the Morphing Meerkat threat which uses DNS over HTTPS to escape detection.

Just days after Google confirmed it is bringing its next AI upgrade to Gmail, with major privacy implications, there’s more good and bad news for the 3 billion users relying on Google to deliver secure, spam-free email to their phones and computers.

Cybercriminals have created a new technique to serve phishing emails to business users which are almost indistinguishable from legitimate messages.

A phishing kit was observed using DNS mail exchange (MX) records that direct emails to mail servers to dynamically serve fake, tailored login pages that’s spoofed more than 100 brands.

A phishing-as-a-service (PhaaS) platform has been observed generating phishing kits that use DNS mail exchange (MX) records to serve fake login pages spoofing over 100 brands, cybersecurity company Infoblox reports.

More than 100 brands' login pages have been spoofed by the newly emergent Morphing Meerkat phishing-as-a-service platform through the exploitation of Domain Name System mail exchange records, The Hacker News reports.

A newly discovered phishing-as-a-service (PhaaS) operation that researchers call Morphing Meerkat, has been using the DNS over HTTPS (DoH) protocol to evade detection.

A sophisticated phishing operation known as Morphing Meerkat is putting internet users at serious risk. Discovered by cybersecurity researchers at Infoblox, this phishing-as-a-service platform has been quietly active since at least 2020.

Cybersecurity researchers have shed light on a new phishing-as-a-service (PhaaS) platform that leverages the Domain Name System (DNS) mail exchange (MX) records to serve fake login pages that impersonate about 114 brands.