Published · 15h agoSecurity2 min read
A ReliaQuest employee gave up a password and an MFA push five days after the company named the .claims campaign. Device trust, not training, kept the session worthless.
Not a builder's beat, but builders have a standing stake in it.
Compiled by The WatchSomething wrong?How this is made
BleepingComputer put the lookalike host at reliaquest.claims [7]. That is the pattern ReliaQuest itself had published five days earlier, the target's name or abbreviation under the .claims TLD [2][5], which means the indicator already existed inside the company that then walked into it. The gap was not intelligence. It was that a phone call using a real colleague's name is sufficient [4].
The push notification was approved, so the second factor did exactly what it was built to do and bought nothing [4]. What mattered afterwards was device binding: ReliaQuest says a non-ReliaQuest device cannot reach any application or system, valid credential or not [10]. Its write-up is unusually plain about starting from the assumption that someone will eventually be phished [11]. Containment then followed the identity rather than the endpoint, with sessions terminated, the password expired and every authentication factor reset [12], plus an audit reaching back to August 21 that turned up nothing further [13].
View-only is not harmless. The attacker kept trying to open applications from the dashboard [9], which tells you the session was functioning as a list of what was worth attempting [24]. Nobody has said how many staff were called [4]. The number that actually describes the outcome is how many business applications a valid credential opened from an untrusted device, and on ReliaQuest's account that was zero [23].
Then the strange part. The group listed the company on August 23 with screenshots that appear to show an Okta SSO account [15][16] and a message telling ReliaQuest to leave reporting on it to Mandiant [17]. Speaking to BleepingComputer, ShinyHunters described its own access in the same terms as its victim did [20], in wording identical to the sentence ReliaQuest published [22]. SOCRadar's assessment is that the public taunting does not substantiate the breach claim or demonstrate access to ReliaQuest networks [19]. When the extortion post and the incident report agree on the blast radius, the thing on sale is embarrassment, which is why the firm's denial is aimed at the words compromise and ransomware [18].
The asymmetry is worth naming. The same call, the same entered password and the same approved push, at an organization where the identity provider is effectively the front door, ends in notification letters rather than a blog post. ReliaQuest could publish because the answer to what the session reached was small enough to publish [8].
Ranked by verification strength, evidence, and original report placement.
ReliaQuest confirmed that one of its own employees fell for a social engineering attack, handing attackers a password and a brief window into the company's identity system.
On August 17 ReliaQuest's Threat Research team posted on X that it was tracking a widespread ShinyHunters campaign using domains following the company[.]claims pattern, incorporating the targeted organization's name or abbreviation under the .claims TLD.
ReliaQuest warned that the group had been expanding its social engineering tactics to include legal team impersonation alongside IT and help desk impersonation.
According to ReliaQuest's write-up, it was targeted by a social engineering attack on August 22: the actor called multiple teammates, each time posing as a security employee by name, and one teammate entered their password and approved the push notification on their phone, handing the attacker a brief session on the identity dashboard.
ReliaQuest said the threat actor registered a lookalike domain and stood up a fake ReliaQuest single sign-on page behind a content delivery network.
BleepingComputer found the lookalike domain used to host the phishing page to be reliaquest.claims.
The reporting this story was synthesized from, earliest first. Every link goes to the original.
