This weekly roundup includes two real social-engineering-driven incidents. Attackers used social engineering to access Apollo Global Management’s cloud platforms and steal sensitive personal data, and separately attempted a ShinyHunters phishing attack against ReliaQuest using a fake SSO login page and an MFA prompt approval to gain limited access.
Two separate incidents show how social engineering continues to bypass technical defenses even when multi-factor authentication is in place. In the ReliaQuest case, an employee was presented with a fake single sign-on (SSO) login page. After the employee entered credentials, the attacker triggered an MFA push request, and the employee approved it. This combination, credential theft followed by MFA approval, gave the attacker temporary, view-only access to a dashboard.
Separately, Apollo Global Management's cloud platforms were accessed through social engineering, resulting in the theft of sensitive personal information, including names, addresses, dates of birth, and Social Security numbers. The exact method used to gain access to Apollo's cloud environment was not detailed, but it fits a broader pattern of attackers targeting account access and cloud platforms rather than exploiting software vulnerabilities directly.
The ReliaQuest attempt succeeded at the initial step because the fake SSO page looked convincing enough that an employee entered real credentials, and because the follow-up MFA prompt was approved rather than questioned. This reflects a known weakness in push-based MFA: it depends on the user correctly identifying an unexpected authentication request as suspicious in the moment, which is not always intuitive under time pressure.
In the Apollo case, social engineering targeting cloud platform access again points to how attackers look for the human decision point, whether that's a help desk process, an account recovery flow, or a login request, rather than trying to break through technical barriers directly.
At ReliaQuest, the impact was contained by controls that did not depend solely on the login step:
This illustrates that stopping credential theft entirely is difficult, but limiting what a stolen credential can actually do is achievable through layered access controls.
Defenders across all employee levels, help desk, IT, cloud administration, and security operations should treat the following as red flags:
Recommended steps include strengthening help-desk and account-recovery verification procedures, applying device-trust and least-privilege principles to dashboards and cloud platforms, and training employees to pause and verify through a separate trusted channel before approving any unexpected MFA prompt. When credentials are suspected of being entered into a phishing page, revoking them immediately and checking for persistence, as ReliaQuest did, is an effective containment step.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
An employee entered credentials into a fake SSO page and approved an MFA request during a ShinyHunters attack, giving the attacker temporary, view-only dashboard access.
Device-trust controls blocked access to sensitive systems and customer information, and the credentials were revoked with no persistence found.
Attackers used social engineering to breach Apollo Global Management's cloud platforms and steal sensitive information including names, addresses, dates of birth, and Social Security numbers.
Strengthen help-desk and account-recovery verification, apply device-trust and least-privilege controls, and train employees to treat unexpected SSO logins and MFA prompts as high-risk signs of phishing.
An employee at ReliaQuest typed their password into a fake SSO page, tapped approve on MFA… and the attacker was in. This wasn’t theory. ShinyHunters used a fake company SSO site, then an MFA push, to get temporary, view-only dashboard access at ReliaQuest. Apollo Global Management was hit too, via social engineering of their cloud platforms, and attackers stole personal data, including Social Security numbers. Here’s the trap: you get an email, click a link, see a login page that looks just like our SSO, you sign in, and then, ding, an MFA prompt you weren’t expecting. That combo is the giveaway. If you didn’t start the login yourself, that page and that push are almost certainly phishing. Your move: if a login page or MFA push is unexpected, hit deny, close the page, and report it to security immediately so we can revoke any credentials and check for persistence.
This weekly roundup describes multiple real-world campaigns where attackers trick people using familiar brands and “verification” prompts to steal credentials or install remote-control tools. The common theme is trust abuse: messages and web pages look legitimate, then push users to log in, click…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
The article reports real-world social engineering operations, including a hotel Wi‑Fi campaign that pushed fake updates and device-code phishing to steal Microsoft 365 access. It also describes an alleged Microsoft Entra vishing campaign tied to data theft claims at Brinks Home, reinforcing the…
Sophos reports real incidents where attackers impersonated well-known AI brands (especially Claude) to trick people into installing malware. The lures included polished fake installer pages that instruct victims to copy/paste commands, and browser extensions that look legitimate via high ratings…
This weekly roundup highlights multiple real-world social engineering threats, including fake IT help-desk phone calls that push employees to phishing sites to steal passwords and one-time authentication codes. It also describes credential-phishing sites impersonating WhatsApp and Instagram that…
Attackers are taking over hotel and conference Wi‑Fi gateways and changing DNS settings so travelers are silently redirected to fake Microsoft 365 sign-in pages. Victims are then tricked into completing a device-code login that grants attackers a legitimate session token, often bypassing MFA. This…
