GoKawiilReliaQuest says ShinyHunters phishing attempt was blocked before data access
ReliaQuest confirmed that ShinyHunters attackers impersonated its own security staff in vishing calls, directing an employee to a fake single sign-on page hosted on a lookalike domain, reliaquest.claims. The employee entered credentials and approved an MFA prompt, giving attackers brief, view-only access to an identity dashboard, but device-trust controls stopped further access to systems or customer data.
GoKawiil's interpretation of the reporting above, not reported fact.
The irony of a threat-intel firm being targeted by the same .claims domain scheme it had just exposed shows how aggressively ShinyHunters is scaling social engineering campaigns against security vendors themselves. It also demonstrates that layered defenses like device-trust checks can contain damage even after credentials and MFA are compromised, offering a real-world case study for other enterprises facing similar vishing tactics.
- ShinyHunters used .claims domains mimicking company names to impersonate help desks and IT teams.
- A ReliaQuest employee was tricked into entering credentials and approving MFA on a fake SSO page.
- Device-trust controls limited the breach to view-only access, preventing system or customer data compromise.
YubiKey 5C NFC Security Key — Phishing pages that mimic a company SSO login only work if the credential can be replayed — a hardware security key like the YubiKey 5C NFC binds authentication to the real domain, so a fake 'company.claims' portal gets nothing. It's a simple USB-C and NFC key that works with Okta, Google, Microsoft and password managers, making it a practical defense against exactly the social engineering campaign described here.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-24
Published there as: “ReliaQuest confirms failed data-theft attack after ShinyHunters breach”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.