Infoblox Threat Intel<p>We published a blog yesterday about a PhaaS and phishing kit that employs DoH and DNS MX records to dynamically serve personalized phishing content. It also uses adtech infrastructure to bypass email security and sends stolen credentials to various data collection spaces, such as Telegram, Discord, and email. <a href="https://blogs.infoblox.com/threat-intelligence/a-phishing-tale-of-doh-and-dns-mx-abuse/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blogs.infoblox.com/threat-inte</span><span class="invisible">lligence/a-phishing-tale-of-doh-and-dns-mx-abuse/</span></a></p><p><a href="https://infosec.exchange/tags/dns" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>dns</span></a> <a href="https://infosec.exchange/tags/doh" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>doh</span></a> <a href="https://infosec.exchange/tags/mx" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mx</span></a> <a href="https://infosec.exchange/tags/adtech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>adtech</span></a> <a href="https://infosec.exchange/tags/obfuscation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>obfuscation</span></a> <a href="https://infosec.exchange/tags/phaas" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phaas</span></a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phishing</span></a> <a href="https://infosec.exchange/tags/phishingkit" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phishingkit</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybercrime</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/infoblox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infoblox</span></a> <a href="https://infosec.exchange/tags/infobloxthreatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infobloxthreatintel</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/wordpress" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>wordpress</span></a> <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>spam</span></a> <a href="https://infosec.exchange/tags/telegram" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>telegram</span></a> <a href="https://infosec.exchange/tags/discord" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>discord</span></a> <a href="https://infosec.exchange/tags/morphingmeerkat" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>morphingmeerkat</span></a></p>