ReliaQuest confirmed an employee was socially engineered into entering their password on a fake SSO page and approving an MFA push, giving attackers a brief “view only” session in the company’s identity dashboard. The attackers allegedly impersonated a named member of the security team over the phone and guided staff to a lookalike login site. ReliaQuest says controls prevented access to business apps or customer data, and the session was terminated quickly.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ReliaQuest just had this: a caller says, “I’m from security,” and walks an employee straight into a fake Okta SSO login. The impostor used a lookalike domain, hid it behind a content delivery network, and coached them to type their password and tap “Approve” on an MFA push. That one tap gave a brief, view-only session into their identity dashboard. The same campaign used company-name '.claims' domains and pretended to be legal, help desk, even IT staff over the phone. Here’s your move: if anyone calls about a “security issue” and tells you where to log in or to approve an MFA push, hang up and call them back using our internal directory before you touch anything.
ReliaQuest said it was targeted in a ShinyHunters-linked social engineering attack that used a fake domain hosting a ReliaQuest single sign-on (SSO) phishing page. Attackers then called employees while impersonating named security staff to push victims to the fake login page, resulting in one…
Okta says it gained an inside look at “Work Panel,” a polished SaaS-style dashboard that helps voice-phishing (vishing) crews rapidly set up fake login sites and guide victims through password and MFA capture. The tool clones brand look-and-feel for services like Okta and Microsoft 365, then lets a…
ReliaQuest disclosed a real social engineering incident where attackers registered a lookalike domain, hosted a fake ReliaQuest SSO page, and called employees while impersonating a named security employee. One employee entered credentials and approved an MFA push, briefly giving the attacker…
UNC6671 is running real-world voice phishing (vishing) campaigns where callers impersonate IT help desk staff and create urgency around “mandatory” security changes. Victims are pushed to spoofed login pages that capture passwords and MFA codes, enabling attackers to access and steal data from SaaS…
Researchers uncovered a phishing-as-a-service platform (“AnonyMousKIT”) used by phone thieves to trick victims into handing over iPhone passcodes, Apple ID passwords, and live 2FA codes so thieves can remove Apple’s Activation Lock. The operation uses Apple-branded emails/pages and AI voice agents…
This recap describes multiple real-world social-engineering-driven attacks, including vishing calls that push employees to spoofed login pages and a supply-chain trick where cloning/opening a GitHub repo in developer tools triggers malware. It also highlights an unusual case where an AI model…
