Security1 publisher2 min readPublished
A caller posing as ReliaQuest's security team turned one push approval into a live session
ReliaQuest says an August 22 caller named a real colleague to steer staff onto a lookalike single sign-on page, and the password plus push approval that followed bought a brief session on its identity dashboard.
The Watch · Security desk
What happened
- ReliaQuest confirmed that on August 22, 2026 one of its employees was targeted in a social engineering attack in which the callers impersonated a member of the company's own security team.
- The actor registered a lookalike domain, stood up a fake ReliaQuest single sign-on page behind a content delivery network, then rang teammates one at a time posing as a named security employee.
- One teammate entered a password and approved the phone push, giving the attacker a brief view-only session on the identity dashboard; ReliaQuest says no applications, systems or customer data were reached.
- ReliaQuest named no actor but said the playbook matches ShinyHunters and other extortion crews, and the crew has since listed the company on its dark web portal.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Push approval and authenticator enrollment are where this class of intrusion is now decided, which makes leaving both at their defaults an active choice to let a caller finish the chain.
- cost At $16,800 a year for a full Android fraud bot, tooling price is not the constraint on how many of these operations run; the defender's cost lands instead on callback friction applied to every internal security request.
- capability Keeping an operator in the loop makes an intercepted 2FA code usable while it is still valid, so code-based MFA degrades from a control into a delay.
- exposure The only prerequisite for the call is a discoverable org chart, which puts any organisation with named security staff and push-based MFA inside the target set.
The step that failed was persistence. Among the playbook markers ReliaQuest lists is a rapid attempt to enroll a new authenticator [7], which is the difference between a session that expires on its own and a factor the attacker still holds after the password reset. The access it did get was view only on the identity dashboard, with no applications or systems reached and no customer data touched, according to the company [5]. That bounds the damage, not the objective.
The lookalike domain was registered and burned inside the hour [7]. Reputation and domain-age scoring get no window that short. The controls that fit that timeline are a callback rule and an enrollment policy, and both sit in the identity provider rather than at the perimeter.
ReliaQuest's overlap with ShinyHunters is behavioural: an impersonation call, a throwaway domain, a harvesting page behind a content delivery network, MFA push abuse, an authenticator enrollment attempt [7]. That pattern does not separate the crew from anyone who has copied it, and the portal listing [8] is the crew's own claim rather than a forensic link. The reliaquest[.]claims domain from last week's tracking [9] is the closest thing to a thread between the two.
The price list in the same bulletin explains the drift. Octagon, the Android on-device fraud bot that iVerify says AndroidKitKat rents for $1,400 a month with hidden VNC and SMS and one-time password interception [14], runs $16,800 a year [1]. The chain against ReliaQuest needed a domain, a CDN-fronted copy of a login page and a phone list [2][3], and it exploited no software at all [2].
The harvesting side is improving on the same axis. Cisco Talos describes JWR as an operator-driven framework that holds an AES-CTR encrypted WebSocket open so the actor steers each victim session live instead of logging submissions [11], collecting identity documents, Social Security numbers, PayPal credentials and 2FA codes [12], and assessed as a variant of The Outsider platform [13]. A live operator makes a one-time code useful inside its validity window. The fake productivity apps in the same roundup work the same seam from the software side: Electron builds such as Kitchen Canvas and DocConvertWizard function as advertised while gaining injected script execution and desktop capture through Electron APIs [15].
The bulletin's headline sold scale: 296,000 IoT nodes, more than 100 water systems targeted, a SharePoint RCE chain [16]. The week's most transferable technique was a phone call that named a real colleague [3].
What to watch
- Whether ReliaQuest names an actor or publishes the lookalike domain, which would move the ShinyHunters overlap from behavioural to evidentiary.
- Whether the same named-colleague call pattern lands at another security vendor whose internal team roster is public.
- Whether JWR turns up against enterprise SSO pages rather than retail checkouts, putting a live operator inside a corporate MFA prompt.