ShinyHunters taunts ReliaQuest after its own employee falls for social engineering attack
ShinyHunters mocked ReliaQuest after a fake-SSO social engineering call gave attackers brief view-only access to its identity dashboard via one employee.
ReliaQuest confirmed that on August 22, 2026, a caller posing as a named security team member directed an employee to a fake single sign-on page, capturing a password and an approved MFA push notification. The attackers, linked to extortion group ShinyHunters, obtained brief view-only access to the identity dashboard, with no applications, systems, or customer data reached and no persistence established. ShinyHunters posted screenshots claiming access to a ReliaQuest Okta SSO account on its leak site on August 23, contradicting the company's account. The incident followed ReliaQuest's warning about a ShinyHunters campaign using .claims TLD domains to impersonate legal, help desk, and IT staff.
- Fake SSO page hidden behind a CDN, reached via calls impersonating named security staff
- Employee entered password and approved an MFA push, granting brief identity dashboard access
- ReliaQuest says access was view-only, no customer data touched, no persistence
- ShinyHunters posted Okta SSO screenshots on its leak site claiming a bigger win
- Untrusted devices could not reach applications even with valid credentials
- ATT&CK
- T1566.004 Spearphishing VoiceT1557.002 Adversary-in-the-MiddleT1621 Multi-Factor Authentication Request GenerationT1078 Valid Accounts
- Vendors
- Okta
- Threat actors
- ShinyHunters
- Victims
- ReliaQuest
- Organizations
- ReliaQuestShinyHuntersSOCRadarMandiant
From the original article
2 min read at helpnetsecurity.com
Cybersecurity company ReliaQuest has confirmed that one of its own employees fell for a social engineering attack, handing attackers a password and a brief window into the company’s identity system. The admission came after the extortion group ShinyHunters posted screenshots on its leak site, claiming a bigger win. The incident was preceded by an unusual exchange on X several days earlier.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.