Sign in Subscribe
Malware and Ransomware

Muddling Meerkat Linked to Domain Spoofing in Global Spam Scams

Muddling Meerkat Linked to Domain Spoofing in Global Spam Scams

Latest News on Domain Spoofing and Malspam Campaigns 2025

Domain Spoofing and Malspam Campaigns

In recent weeks, cybersecurity researchers have identified several sophisticated malspam campaigns that continue to exploit domain spoofing techniques to bypass email security measures.

Abuse of Disused Domains

Attackers are increasingly using neglected or disused domains that lack proper DNS records to distribute phishing emails. These domains are harder to detect and can evade security mechanisms like DKIM, DMARC, and SPF, which are designed to prevent email spoofing1.

Phishing Techniques

Several phishing techniques have been observed:

  • Tax-Related Lures: Phishing emails containing QR codes that redirect users to malicious sites, often targeting users with tax-related lures to divulge personal and financial information.
  • Brand Impersonation: Attackers impersonate well-known brands like Amazon and Mastercard, redirecting users to fake login pages to steal credentials.
  • Extortion Emails: Emails claiming access to compromising videos via malware, demanding Bitcoin payments.
  • Industry-Specific Targets: Recent campaigns target industries such as government and construction, using trusted platforms like Canva and Dropbox to host phishing pages. These campaigns often employ Cloudflare Turnstiles to evade detection by email security tools1.

Use of Generic Top-Level Domains (gTLDs)

Generic top-level domains (gTLDs) like .top and .xyz are being increasingly used for cybercrime due to their low registration fees and lax regulations. These domains now account for 37% of malicious domains1.

Advanced Tools and Strategies

Attackers are using tools like PhishWP, a malicious WordPress plugin, to create fake payment gateways aimed at harvesting sensitive user information in real-time. Additionally, SMS phishing schemes, such as those impersonating law enforcement in the UAE, have been reported1.

Muddling Meerkat Cybersecurity Research

While there is no specific detailed information available on "Muddling Meerkat" research in the provided sources, it is mentioned in the context of collaboration efforts to strengthen defenses against cybersecurity threats. Collaboration in cybersecurity research, such as the efforts associated with "Muddling Meerkat," is highlighted as essential for innovating and improving cybersecurity defenses2.

Analysis of Malspam Techniques

Email Spoofing

  • Attackers continue to spoof sender email addresses effectively, despite the presence of email authentication protocols like SPF, DKIM, and DMARC. This is often achieved by using disused domains that lack proper DNS records13.

Malicious Domains and gTLDs

  • The use of generic top-level domains (gTLDs) with low registration fees and lax regulations has become a significant issue, as these domains are frequently used for malicious activities1.

Advanced Malware and Tools

  • Tools like ANEL (a backdoor) and NOOPDOOR (a complex implant) are being used by threat actors like MirrorFace to conduct long-term campaigns against targets in Japan and other countries. These tools enable attackers to capture screenshots, upload and download files, and run commands with elevated privileges1.

Phishing and Social Engineering

  • Phishing campaigns are becoming more sophisticated, using trusted platforms and impersonating law enforcement or big brands to trick victims into divulging sensitive information. The use of QR codes and fake login pages is also prevalent1.

Evading Detection

  • Attackers are employing various techniques to evade detection, including the use of Cloudflare Turnstiles and Visual Studio Code remote tunnels to establish C2 connections and enable remote system access1.

In summary, the latest malspam campaigns are characterized by the exploitation of disused domains, advanced phishing techniques, and the use of sophisticated malware and tools to evade detection and harvest sensitive information. Collaboration in cybersecurity research, such as that hinted at by "Muddling Meerkat," remains crucial in combating these evolving threats.

Read next