ReliaQuest thwarts phishing attempt after ShinyHunters impersonation

ReliaQuest confirmed that an employee was tricked into entering credentials on a fake single sign-on page during a social engineering attack. The attacker, impersonating a security team member, gained view-only access to the identity dashboard but was blocked from applications by device-trust controls. No customer data was accessed, and the company revoked the exposed credentials.

EXPANDED:

The attack began with vishing calls impersonating a real security employee, directing the target to a lookalike domain (reliaquest.claims) hosting a fake SSO page. The employee entered credentials and approved an MFA push, granting the attacker temporary view-only