Reported by 4 outlets

Timeline

1. original reporting

   Hackers Impersonate Security Staff to Steal Credentials in ReliaQuest Social Engineering Attack

   gbhackers.com · 50d ago · August 24th, 2026

   ReliaQuest has reported a targeted social engineering attack in which threat actors impersonated company security personnel, used a spoofed domain, and successfully persuaded one employee to approve a malicious multi-factor authentication (MFA) request. The incident, detected on August 22, 2026, resulted in the temporary exposure of a single identity session with view-only access to ReliaQuest’s […] The post Hackers Impersonate Security Staff to Steal Credentials in ReliaQuest Social Engineering Attack appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   ReliaQuest Thwarts Social Engineering Attack Using Fake SSO and MFA Push Abuse

   cyberpress.org · 50d ago · August 24th, 2026

   A targeted social-engineering attack that used a lookalike single sign-on portal, phone-based employee impersonation, and abuse of MFA push to gain temporary access to a single user identity. The incident, documented by ReliaQuest and detected on August 22, 2026, did not result in access to customer data, business applications, or internal systems, Although one employee entered credentials on a fraudulent page and approved a push notification, layered identity and device security controls limited the attacker’s access and enabled rapid containment. ReliaQuest Thwarts Social Engineering Attack ReliaQuest said claims that it suffered a ransomware compromise or broader breach are false. The operation began with the registration of a domain that resembled a legitimate ReliaQuest property. Threat actors then deployed a counterfeit ReliaQuest SSO page behind a content delivery network, a tactic that can help obscure hosting infrastructure and support fast, disposable phishing campaigns . The attackers called several employees and impersonated members of the company’s security team by name. The calls were intended to direct targets toward the malicious authentication page and persuade them to complete the login process. One employee ultimately submitted a password and accepted an MFA push notification, allowing the attackers to obtain a short-lived session in ReliaQuest’s identity dashboard. Attackers attempted to use that session to acce

3. update from bleepingcomputer.com

   ReliaQuest confirms failed data-theft attack after ShinyHunters breach

   bleepingcomputer.com · 50d ago · August 24th, 2026

   In a statement over the weekend, ReliaQuest said that an attacker called multiple employees and tried to trick them into accessing "a fake ReliaQuest single sign-on (SSO) page behind a content delivery network." Last week, ReliaQuest's Threat Research team shared in a now-deleted post , that the ShinyHunters extortion gang was registering .claims domains to impersonate company's help desks and IT teams. "ReliaQuest is tracking a widespread ShinyHunters campaign using domains that follow the company[.]claims pattern. These domains incorporate the targeted organization’s name or abbreviation under the .claims TLD," read the company's post on X. Yesterday, a newly-created X account believed to be linked to the threat actors replied to the post, stating "Who's hunting who ?," sharing screenshots of what appeared to be a compromised Okta SSO account for a ReliaQuest employee. Soon after, ShinyHunters published the same screenshots in a new entry on their data data leak site. Both ReliaQuest's and the alleged threat actor's posts were later taken down from X. According to the company, the threat actor hosted the phishing page on a "lookalike domain," which BleepingComputer learned from sources was reliaquest.claims , and used the name of a real security employee during the vishing attempts.

4. mentioned by securityweek.com

   ReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited

   securityweek.com · 50d ago · August 24th, 2026

5. update from securityweek.com

   ReliaQuest (SOC) Got Vished.

   securityweek.com · 29d ago · September 14th, 2026

   Knowing the company this publicity is not favorable for sure but goes to show training is important! submitted by /u/AccomplishedJuice135 [link] [comments]

   via reddit r/cybersecurity: ReliaQuest (SOC) Got Vished.