ShinyHunters Targets ReliaQuest Employee via Fake SSO Page
Written by AI from the linked story. Not reviewed by an editor. How this works
A ReliaQuest employee was socially engineered by the ShinyHunters gang, who impersonated internal security staff to steal credentials and MFA approvals through a convincing fake SSO portal. This attack highlights how even security-focused organizations are vulnerable to credential phishing when employees cannot distinguish legitimate login pages from spoofed ones. The incident demonstrates that MFA alone is insufficient if users can be manipulated into approving fraudulent authentication requests — a technique known as MFA fatigue or real-time phishing proxying. Fortunately, defense-in-depth controls limited the blast radius, preventing access to sensitive applications or customer data. This serves as a critical reminder that human factors remain the most exploitable attack surface regardless of technical sophistication.
Tactical Insight
Immediate actions
- Deploy phishing-resistant MFA (e.g., FIDO2/passkeys) to eliminate credential and MFA-intercept attacks via fake SSO pages.
- Conduct targeted social engineering awareness training focused on impersonation scenarios involving internal IT or security staff.
- Implement strict URL verification policies and browser-based anti-phishing controls for all SSO and identity provider login pages.
Long-term improvements
- Enforce least-privilege access controls so that any compromised identity dashboard access is limited to the minimum necessary scope.
- Adopt a Zero Trust architecture requiring continuous verification of device health, user identity, and context before granting application access.
- Establish identity threat detection rules that alert on anomalous login locations, new device enrollment, or dashboard access outside normal patterns.
Detection measures
- Monitor identity and SSO platforms for unusual authentication patterns, such as logins from unexpected IPs or user agents.
- Integrate identity provider logs with your SIEM to correlate credential access events with downstream application activity in real time.
- Run regular tabletop exercises simulating social engineering attacks against IT and security personnel to validate detection and response playbooks.