Cybersecurity company ReliaQuest has confirmed that one of its employees was targeted in a social engineering attack after hackers impersonated a member of the security team.
In a statement over the weekend, ReliaQuest said that an attacker called multiple employees and tried to trick them into accessing “a fake ReliaQuest single sign-on (SSO) page behind a content delivery network.”
Last week, ReliaQuest’s Threat Research team shared in a now-deleted post, that the ShinyHunters extortion gang was registering .claims domains to impersonate company’s help desks and IT teams.
“ReliaQuest is tracking a widespread ShinyHunters campaign using domains that follow the company[.]claims pattern. These domains incorporate the targeted organization’s name or abbreviation under the .claims TLD,” read the company’s post on X.
Yesterday, a newly-created X account believed to be linked to the threat actors replied to the post, stating “Who’s hunting who ?,” sharing screenshots of what appeared to be a compromised Okta SSO account for a ReliaQuest employee. Soon after, ShinyHunters published the same screenshots in a new entry on their data data leak site. Both ReliaQuest’s and the alleged threat actor’s posts were later taken down from X.
According to the company, the threat actor hosted the phishing page on a “lookalike domain,” which BleepingComputer learned from sources was reliaquest.claims, and used the name of a real security employee during the vishing attempts.
One of the targeted employees fell for the attacker’s ruse, entered their credentials on the fake SSO page, and approved an MFA push notification, giving the attacker temporary, view-only access to ReliaQuest’s identity dashboard.
However, device-trust controls successfully blocked subsequent attempts to access applications through the dashboard, according to the company.
“The extent of the access was view-only. No ReliaQuest applications or systems were accessed, and no customer data was ever touched,” ReliaQuest says.
“The threat actor continued with attempts to access these applications from the dashboard but was consistently denied due to the security controls in place.”
The cybersecurity firm says it terminated the attacker’s sessions, revoked the exposed password, and reset all authentication tokens.
The ensuing investigation found no evidence of access to other accounts, apps, or data, and no signs that the actor established persistence on ReliaQuest’s systems.
The firm audited its control fidelity, device trust, and on-network access since August 21 and identified no suspicious activity.
ReliaQuest’s statement comes shortly after the infamous data extortion group ‘ShinyHunters’ claimed an attack on the company.
In a new post on its extortion portal, ShinyHunters references ReliaQuest’s previous reporting on the threat group, saying “this time the post is about you, not us.”
The threat actors published evidence of access, showing that they had successfully breached ReliaQuest’s Okta SSO account.
We asked ReliaQuest if the disclosed incident is linked to ShinyHunters, but we have not received any additional information yet.
However, ShinyHunters told BleepingComputer that their access was view only and did not reach any applications, systems, or customer data.
“No additional identities were accessed, no business applications were reached, no customer or ReliaQuest data was accessed beyond the user’s login credentials, and no persistence was established,” the threat actor told us.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
RingCentral data breach exposed info of 1.6 million accounts
The Modern Attack Chain: Rethinking Google Workspace Security in the Age of AI
Levi Strauss & Co. says hackers stole corporate data in cyberattack
Man gets six years for hacking 750 women’s Snapchat accounts
Webinar tomorrow: Why modern email attacks require a new approach to defense
Hackers infect Android car head units with proxy botnet malware
ToxicPanda Android malware uses VPN permissions to block Google Play
Microsoft Teams now lets admins block external bots from meetings
Discover why encryption and key management are critical for modern business.
Protect yourself from data brokers, scammers, and the next data breach with digital identities.
Discover how least agency keeps your AI tools capable, controlled, and secure.
Signature-based prevention fell to 50%. See what your controls still stop.
Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.
See how AI is reshaping email attacks. Download the 2026 Kaseya Email Security Report.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
