Residential Proxies Help Social Engineers Evade Location-Based Sign-In Checks
Summary
ReliaQuest says attackers use victim-matched residential proxies to make socially engineered logins and device registrations appear local, then rapidly access SaaS data through built-in APIs. It recommends phishing-resistant MFA and managed-device controls.
Key points
- ReliaQuest reports that attackers route authentication and device registration through residential IP addresses near a victim’s expected location, weakening geographic-anomaly and IP-reputation signals.
- The reported attack chain uses calls, SMS messages, or collaboration requests to direct victims to fake identity, passkey, or enrollment pages; it does not require malware or a software exploit.
- ReliaQuest says actions on objectives began about six minutes after initial access in one incident and about 15 minutes in another.
- Attackers used built-in SaaS APIs, including Microsoft Graph, to enumerate and access data; one reported incident involved tens of thousands of file-access events across hundreds of SharePoint sites.
- In another incident, ReliaQuest observed an automated query session that scanned more than 23 billion database rows and extracted about 136GB over 14 hours.
- ReliaQuest says files appeared on data-leak sites in some cases even though available telemetry showed file-access events without corresponding download events.
- ReliaQuest recommends phishing-resistant MFA, managed-device requirements, hardened account-recovery workflows, and correlating identity changes with rapid SaaS data access.
Article Details
- Attack Vectors
- Attackers contact employees by phone, SMS, or external collaboration requests, impersonating IT help-desk, HR, or legal staff and directing victims to fake identity, passkey, or enrollment pages.
- After capturing credentials or session tokens, attackers route authentication and device registration through residential proxies near the victim’s expected location to make sessions appear geographically normal.
- Attackers may register a device or authentication method to maintain access, including after a password reset.
- Using compromised identities, attackers enumerate and access cloud data through built-in SaaS APIs, including Microsoft Graph, and may retrieve data through file access, previews, synchronization, or automated queries rather than conventional downloads.
- Stolen information is used to support extortion, with threats to publish or sell data.
- Defensive Notes
- Require phishing-resistant MFA, such as FIDO2 security keys or platform-bound passkeys, and retire SMS, push-to-approve, and TOTP where possible.
- Require managed, compliant devices for access to sensitive SaaS applications, using Conditional Access to block untrusted devices.
- Require out-of-band identity verification for password resets, MFA enrollment, and account unlocks; use known contact information for callbacks.
- Block newly registered and organization-impersonating domains at web gateway and DNS layers, and train employees to verify unexpected requests through established channels.
- Correlate password resets, MFA enrollment, authentication-method changes, and device registration with subsequent Microsoft Graph activity, SaaS enumeration, and bulk file access.
- Treat high-volume or unusual file-access activity, automated API use, and access across many sites as potential exfiltration even when logs lack explicit download events.
- Revoke active sessions and OAuth tokens, remove unauthorized authentication methods and registered devices, and disable access in connected federated applications and sandboxes.
- Use rapid detection and containment, including source-side identity and SaaS telemetry and automated response to terminate sessions and remove attacker persistence.
MITRE ATT&CK
T1039 · Data from Network Shared DriveThe article describes high-volume access to and retrieval of files from cloud file-sharing environments; a ReliaQuest detection rule targets mass file downloads from file shares.T1078.004 · Cloud AccountsAttackers use compromised identities to authenticate to cloud applications and access connected SaaS environments.T1098.005 · Device RegistrationThe article describes attackers registering devices or authentication methods to establish persistent access; ReliaQuest lists device registration as a detection target.T1566 · PhishingAttackers use phone calls, SMS, and external collaboration requests with impersonation and fake identity or enrollment pages to socially engineer employees.
Threat Actors
Vendors
Microsoftdoes not always produce a clear file-download event. In cloud environments, attackers can use Microsoft Graph and other built-in SaaS application programming interfaces (APIs) to enumerate, open, preview,ReliaQuestThis is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the broader threat landscape—notSalesforceenough data to support extortion. Through single sign-on, one account may reach SharePoint, email, Salesforce, analytics platforms, and sandbox environments. Disabling the user in one application doesn’t always
Products
GreyMatterPhishing-resistant MFA and managed-device policies can prevent access, while GreyMatter Transit detections and Automated Response Playbooks can identify and contain malicious activity before or during exfiltration.Microsoft Graphdoes not always produce a clear file-download event. In cloud environments, attackers can use Microsoft Graph and other built-in SaaS application programming interfaces (APIs) to enumerate, open, preview,Microsoft SharePointIn incidents involving SharePoint, Microsoft Graph API clients generated tens of thousands of file-access events across hundreds of sites. In another incident, an attacker scanned more than 23 billion database rows andSalesforceenough data to support extortion. Through single sign-on, one account may reach SharePoint, email, Salesforce, analytics platforms, and sandbox environments. Disabling the user in one application doesn’t always