PhaaS actor uses DoH and DNS MX to dynamically distribute phishing
Essential information
- Published
- 31/03/2025 19:56
- Modified
- 31/03/2025 19:57
- Tags
- 2025-03-31 cloud malspam morphing meerkat phishing
- Related entities
- 21 observables, 1 intrusion sets (apt), 4 techniques (mitre)
Description
Infoblox discovered a phishing kit that creatively employs DNS mail exchange (MX) records to dynamically serve fake, tailored, login pages, spoofing over 100 brands.