As reported by BleepingComputer, ReliaQuest disclosed that ShinyHunters operatives conducted a voice social engineering (vishing) campaign against its employees using a lookalike domain (reliaquest.claims) hosting a fake Okta SSO page. One employee entered credentials and approved an MFA push, granting the attacker temporary, view-only access to the identity dashboard. Critically, device-trust controls stopped lateral movement dead—no applications, no customer data, no persistence.

Threat Alert: One employee entered credentials and approved an MFA push, granting the attacker temporary, view-only access to the identity dashboard.

This incident is a textbook example of how modern extortion gangs are pivoting from opportunistic data-theft scraping toward precision-targeted identity compromise. ShinyHunters, historically known for scraping exposed databases and selling access on criminal markets, has demonstrably leveled up their tradecraft. The .claims TLD abuse pattern is particularly insidious: it lends an air of legitimacy to phishing infrastructure because it mimics a plausible corporate subdomain structure that most users won't immediately question.

Why This Matters Beyond ReliaQuest

The most important takeaway isn't that a cybersecurity vendor was targeted—it's that the attack partially succeeded. An employee with security awareness training still handed over credentials and approved an MFA challenge. If this can happen at a company whose entire business is security operations, it can happen anywhere.

The saving grace was architectural: ReliaQuest had implemented device-trust policies that require managed, compliant endpoints before granting application access. This is the difference between a near-miss and a catastrophic breach. Many organizations still treat MFA as the finish line when it's merely the starting gate.

The threat model has shifted. Attackers no longer need to defeat your MFA—they need to convince one employee to approve it.

ShinyHunters' Evolving Playbook

Why This Matters Beyond ReliaQuest
Domain registration strategy: Systematic abuse of the .claims TLD to impersonate help desks and IT teams across multiple target organizations.
Vishing + fake SSO: Combining phone calls that reference real employee names with credential-harvesting pages behind CDNs to evade URL filtering.
MFA push exploitation: Relying on user fatigue or social pressure rather than technical MFA bypass.
Public pressure tactics: Using newly created X accounts and data leak sites to amplify perceived success, even when access was minimal.

Shield53 Recommendations

Immediate Actions

  • Audit MFA method: Replace push-based MFA with phishing-resistant factors (FIDO2/WebAuthn security keys or platform authenticators). Push notifications are exploitable through social engineering; hardware keys are not.
  • Enforce device trust: Implement conditional access policies that require managed, compliant, and attested devices before granting access to any SSO-integrated application. If ReliaQuest lacked this, the outcome would have been materially different.
  • Monitor new domain registrations: Subscribe to domain monitoring services that alert on registrations matching your organization's name across all TLDs—especially .claims, .support, .help, and similar service-oriented extensions.
  • Block .claims and similar TLDs: If your business has no legitimate need to receive traffic from these TLDs, consider blocking them at your secure web gateway or DNS filtering layer.

Strategic Hardening

  • Implement number matching: If you cannot immediately migrate to FIDO2, enable number-matching MFA prompts to reduce push-fatigue success rates.
  • Establish a verification protocol: Create a documented, enforced procedure where any IT or security request received via phone must be verified through an out-of-band channel (e.g., a known internal number or ticketing system) before action is taken.
  • Conduct vishing-specific exercises: Traditional phishing simulations don't cover voice-based social engineering. Run tabletop and live vishing exercises that test help desk impersonation scenarios.
  • Review session monitoring: Ensure your identity provider logs and alerts on sessions originating from unrecognized devices, unusual geographies, or view-only dashboard access patterns that may indicate reconnaissance.

ShinyHunters' public bravado—posting screenshots and taunting targets on social media—is designed to manufacture the appearance of a successful breach even when controls held. Defenders should resist the pressure to over-communicate during active incidents and instead let forensic evidence drive the narrative. ReliaQuest's transparent, evidence-based disclosure is a model worth following.