ReliaQuest Reports Employee-Targeted Attack and Temporary View-Only SSO Access
Summary
ReliaQuest says an employee entered credentials and approved an MFA push on a fake SSO page, giving an attacker temporary view-only dashboard access. The company says application access was blocked and no customer data was accessed; ShinyHunters claimed the attack.
Key points
- ReliaQuest says attackers impersonated a security team member and used phone calls and a fake SSO page to target multiple employees.
- One employee entered credentials and approved an MFA push, giving the attacker temporary, view-only access to ReliaQuest’s identity dashboard.
- The company says device-trust controls blocked access to applications; no ReliaQuest applications, systems, or customer data were accessed.
- ReliaQuest terminated the attacker’s sessions, revoked the exposed password, reset authentication tokens, and found no evidence of access to other accounts or persistence.
- Sources told BleepingComputer that the phishing site used the lookalike domain reliaquest[.]claims.
- ShinyHunters claimed the attack and posted screenshots it said showed access to an Okta account; ReliaQuest had not confirmed a link to the group.
Article Details
- Victim Organization
- ReliaQuest
- Incident Type
- Social engineering involving vishing and a fake SSO phishing page; an employee's credentials and MFA approval enabled temporary, view-only access to an identity dashboard.
- Data Types Exposed
- Employee login credentials
- Affected Records
- One employee account; ReliaQuest reported no customer data accessed.
- Operational Impact
- The attacker obtained temporary, view-only access to ReliaQuest's identity dashboard. Device-trust controls blocked access to applications and systems. ReliaQuest terminated the sessions, revoked the exposed password, reset authentication tokens, and reported no evidence of persistence or access to other accounts, applications, or data.
- Ransom Or Extortion
- ShinyHunters claimed the attack and posted screenshots on its extortion portal. No ransom demand or payment was reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | reliaquest[.]claims | Lookalike phishing domain used to host a fake ReliaQuest SSO page. |
MITRE ATT&CK
T1078 · Valid AccountsThe attacker used an employee's credentials and approved MFA push to gain temporary, view-only access to the identity dashboard.T1566.004 · Spearphishing VoiceThe attacker used vishing calls to trick employees into accessing a fake SSO page.T1621 · Multi-Factor Authentication Request GenerationAn employee approved an MFA push notification during the social engineering attack.