[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCrbxn_jfdYpsFV7aAQGHAPj7myfw_GHjFwo-cDFYlL4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":45,"controls":46},"63dcf29e-dfd4-4cfe-812a-b9f79074bd8a","shinyhunters-targets-reliaquest-employee-via-fake-sso-page","3da26bc9-140f-4ff1-8423-7a64149b1e78","ShinyHunters Targets ReliaQuest Employee via Fake SSO Page","A ReliaQuest employee was socially engineered by the ShinyHunters gang, who impersonated internal security staff to steal credentials and MFA approvals through a convincing fake SSO portal. This attack highlights how even security-focused organizations are vulnerable to credential phishing when employees cannot distinguish legitimate login pages from spoofed ones. The incident demonstrates that MFA alone is insufficient if users can be manipulated into approving fraudulent authentication requests — a technique known as MFA fatigue or real-time phishing proxying. Fortunately, defense-in-depth controls limited the blast radius, preventing access to sensitive applications or customer data. This serves as a critical reminder that human factors remain the most exploitable attack surface regardless of technical sophistication.","**Immediate actions:**\n- Deploy phishing-resistant MFA (e.g., FIDO2\u002Fpasskeys) to eliminate credential and MFA-intercept attacks via fake SSO pages.\n- Conduct targeted social engineering awareness training focused on impersonation scenarios involving internal IT or security staff.\n- Implement strict URL verification policies and browser-based anti-phishing controls for all SSO and identity provider login pages.\n\n**Long-term improvements:**\n- Enforce least-privilege access controls so that any compromised identity dashboard access is limited to the minimum necessary scope.\n- Adopt a Zero Trust architecture requiring continuous verification of device health, user identity, and context before granting application access.\n- Establish identity threat detection rules that alert on anomalous login locations, new device enrollment, or dashboard access outside normal patterns.\n\n**Detection measures:**\n- Monitor identity and SSO platforms for unusual authentication patterns, such as logins from unexpected IPs or user agents.\n- Integrate identity provider logs with your SIEM to correlate credential access events with downstream application activity in real time.\n- Run regular tabletop exercises simulating social engineering attacks against IT and security personnel to validate detection and response playbooks.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 4 – Controlled Use of Administrative Privileges","CIS Control 6 – Access Control Management","CIS Control 14 – Security Awareness and Skills Training","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST AT-2 – Literacy Training and Awareness","NIST SI-4 – System Monitoring","NIST SP 800-207 – Zero Trust Architecture","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1557 – Adversary-in-the-Middle","ISO\u002FIEC 27001 A.6.3 – Information Security Awareness",{},"published","2026-08-24T16:20:19.468968+00:00","2026-08-24T16:20:19.169+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Freliaquest-confirms-failed-data-theft-attack-after-shinyhunters-breach\u002F","reliaquest-confirms-failed-data-theft-attack-after-shinyhunters-breach-515763","ReliaQuest confirms failed data-theft attack after ShinyHunters breach",[33,39],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[47,51,55],{"slug":48,"name":49,"problem":50},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":52,"name":53,"problem":54},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":56,"name":57,"problem":58},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]