Full Report
Cybersecurity company ReliaQuest has confirmed that one of its employees was targeted in a social engineering attack after hackers impersonated a member of the security team. [...]
Analysis Summary
# Incident Report: Attempted Social Engineering and Identity Breach (ShinyHunters)
## Executive Summary
ReliaQuest was targeted in a sophisticated social engineering (vishing) campaign orchestrated by the ShinyHunters extortion group. While one employee was compromised via a lookalike SSO page and MFA push fatigue, the attack was successfully mitigated by device-trust controls. No customer data was accessed, and the threat actor was limited to "view-only" access of an identity dashboard before being evicted.
## Incident Details
- **Discovery Date:** August 21, 2026
- **Incident Date:** August 21, 2026
- **Affected Organization:** ReliaQuest
- **Sector:** Cybersecurity / Managed Security Services
- **Geography:** Global / United States
## Timeline of Events
### Initial Access
- **Date/Time:** August 21, 2026
- **Vector:** Social Engineering / Vishing (Voice Phishing)
- **Details:** Attackers placed phone calls to multiple employees impersonating a member of the internal security team. One employee was directed to a lookalike domain (`reliaquest[.]claims`) hosting a fake Single Sign-On (SSO) page.
### Lateral Movement
- **Attempted:** The attacker gained entry to the Okta identity dashboard and attempted to launch various business applications.
- **Outcome:** Blocked. Device-trust controls prevented the attacker from moving from the dashboard into specific applications or systems.
### Data Exfiltration/Impact
- **Scope:** View-only access to the employee’s identity dashboard.
- **Data Stolen:** The employee's login credentials and screenshots of the dashboard (later posted to a leak site for reputational damage). No customer or corporate data was exfiltrated.
### Detection & Response
- **Discovery:** Triggered by internal security monitoring and the identification of the lookalike domain campaign.
- **Response:** Automated and manual security controls denied application access; incident response teams terminated active sessions and reset credentials.
## Attack Methodology
- **Initial Access:** Vishing and Phishing via a lookalike domain (`reliaquest[.]claims`).
- **Persistence:** None established; sessions were terminated promptly.
- **Privilege Escalation:** Not achieved; the attacker remained within the context of a single user.
- **Defense Evasion:** Use of a Content Delivery Network (CDN) to host the phishing page and impersonation of known security staff.
- **Credential Access:** Credential harvesting via a fake SSO page and MFA push harassment/approval.
- **Discovery:** Browsing the user's Okta identity dashboard to identify accessible applications.
- **Lateral Movement:** Attempted via dashboard application launching (Blocked by Device Trust).
- **Collection:** Limited to screenshots of the compromised dashboard.
- **Exfiltration:** Screenshots shared on the "ShinyHunters" extortion portal and social media (X).
- **Impact:** Reputational (attempted extortion/publicity).
## Impact Assessment
- **Financial:** Negligible; no operational downtime or ransom paid.
- **Data Breach:** Limited to one set of employee credentials and dashboard metadata.
- **Operational:** No disruption to business services or customer environments.
- **Reputational:** Moderate; the attacker publicly claimed the breach on X (formerly Twitter) and their leak site to embarrass the security firm.
## Indicators of Compromise
- **Network Indicators:**
- `reliaquest[.]claims` (Phishing Domain)
- `*.claims` (TLD pattern used in wider campaign)
- **Behavioral Indicators:**
- Multiple vishing calls impersonating IT/Security.
- SSO logins from unrecognized devices/locations followed by multiple denied application launch attempts.
## Response Actions
- **Containment:** Terminated all active sessions for the compromised user.
- **Eradication:** Revoked exposed passwords and reset all authentication tokens.
- **Recovery:** Audited device-trust logs and on-network access since August 21 to ensure no other accounts were impacted.
## Lessons Learned
- **Success of Zero Trust:** The incident proves that "Device Trust" (requiring a managed/known device) is a critical secondary defense when MFA is bypassed via social engineering.
- **Vulnerability of Voice:** Vishing remains a highly effective method for bypassing traditional technical controls by exploiting human trust.
- **Public Relations:** Threat actors now use social media (X) to taunt security teams in real-time, requiring a coordinated PR and IR response.
## Recommendations
- **Transition to FIDO2/WebAuthn:** Move away from Push-based MFA to hardware keys or passkeys to prevent MFA fatigue and proxy-based phishing.
- **Employee Awareness:** Conduct specific training on vishing tactics, emphasizing that IT/Security will never ask a user to navigate to a non-standard domain for SSO.
- **Domain Monitoring:** Proactively monitor and block newly registered domains using the company name combined with TLDs like `.claims`, `.support`, or `.help`.