ReliaQuest confirmed an employee was socially engineered into entering their password on a fake SSO page and approving an MFA push, giving attackers a brief “view only” session in the company’s identity dashboard. The attackers allegedly impersonated a named member of the security team over the phone and guided staff to a lookalike login site. ReliaQuest says controls prevented access to business apps or customer data, and the session was terminated quickly.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
ReliaQuest just had this: a caller says, “I’m from security,” and walks an employee straight into a fake Okta SSO login. The impostor used a lookalike domain, hid it behind a content delivery network, and coached them to type their password and tap “Approve” on an MFA push. That one tap gave a brief, view-only session into their identity dashboard. The same campaign used company-name '.claims' domains and pretended to be legal, help desk, even IT staff over the phone. Here’s your move: if anyone calls about a “security issue” and tells you where to log in or to approve an MFA push, hang up and call them back using our internal directory before you touch anything.
ReliaQuest said it was targeted in a ShinyHunters-linked social engineering attack that used a fake domain hosting a ReliaQuest single sign-on (SSO) phishing page. Attackers then called employees while impersonating named security staff to push victims to the fake login page, resulting in one…
Okta says it gained an inside look at “Work Panel,” a polished SaaS-style dashboard that helps voice-phishing (vishing) crews rapidly set up fake login sites and guide victims through password and MFA capture. The tool clones brand look-and-feel for services like Okta and Microsoft 365, then lets a…
Threat groups are actively targeting healthcare and pharma staff using phone-based social engineering (“vishing”) and look‑alike medical domains to steal employee login credentials. Researchers say attackers pressure employees to click password-reset or MFA-reset links, and multiple…
ReliaQuest disclosed a real social engineering incident where attackers registered a lookalike domain, hosted a fake ReliaQuest SSO page, and called employees while impersonating a named security employee. One employee entered credentials and approved an MFA push, briefly giving the attacker…
Okta analyzed thousands of real social-engineering incidents and found most account takeovers still rely on stealing passwords and then bypassing MFA through push prompts or one-time codes. Okta described multiple campaigns where attackers phished credentials and then talked victims into using…
Microsoft described two real-world campaigns: an invoice fraud blast impersonating executives to trick finance teams into ACH payments, and a passkey-themed helpdesk scam that steals or bypasses authentication to take over Microsoft cloud accounts. In the second campaign, victims are called or…
