ReliaQuest

Summary

ReliaQuest was targeted by a ShinyHunters social engineering campaign that used a lookalike domain reliaquest.claims to host a fake single sign‑on page; attackers called employees posing as security staff, one employee entered credentials and approved an MFA push, granting the threat actor view‑only access to the Okta dashboard. Security controls prevented any further access to applications, systems, or customer data, and the attacker’s sessions were terminated, the exposed password revoked, and all authentication factors reset, with no evidence of persistence or data theft.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 17 2026 ReliaQuest posted on X that it was tracking a widespread ShinyHunters phishing campaign that used domains following the company.claims pattern. On August 22 2026 the company said it was targeted in a social engineering attack in which the threat actor registered a lookalike domain and set up a fake ReliaQuest single sign‑on page behind a content delivery network. The attacker called multiple ReliaQuest teammates, each time posing as a security employee by name, attempting to steer them toward the fraudulent page. One teammate entered their password and approved the push notification on their phone, which handed the attacker a brief session on ReliaQuest’s identity dashboard.

The access obtained by the attacker was described as view only; ReliaQuest stated that no applications, systems, or customer data were accessed despite the attacker’s attempts to reach them from the dashboard. Device‑trust controls prevented non‑ReliaQuest devices from accessing any applications or systems, and the threat actor’s continued attempts to reach those applications were consistently denied. ReliaQuest emphasized that no additional identities were accessed, no business applications were reached, and no customer or ReliaQuest data was accessed beyond the user’s login credentials. The company also said that no persistence was established on its systems and that claims of compromise or ransomware involvement were false.

In response, ReliaQuest terminated the attacker’s sessions, revoked the exposed password, and reset all authentication factors. The firm audited its control fidelity, device trust, and on‑network access since August 21 and identified no suspicious activity. The ensuing investigation found no evidence of access to other accounts, apps, or data and no signs that the actor had established persistence. ReliaQuest’s statements were supported by SOCRadar’s analysis, which concluded that the exchanged screenshots illustrated pressure tactics and public taunting but did not substantiate a breach claim or demonstrate access to ReliaQuest networks. The company maintained that the impact of the incident was limited to the view‑only session on the identity dashboard.

Sources

Sources available to members: 4 sources.