ReliaQuest disclosed a real social engineering incident where attackers registered a lookalike domain, hosted a fake ReliaQuest SSO page, and called employees while impersonating a named security employee. One employee entered credentials and approved an MFA push, briefly giving the attacker view-only access to the company’s identity dashboard before sessions were terminated and authentication factors reset.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine this: you get a call from someone who knows your name and claims they’re from security, right here at our company. That’s what happened at ReliaQuest. ShinyHunters registered a lookalike domain, spun up a fake ReliaQuest SSO page, then called employees pretending to be a named security staffer and pushed them to that site. One teammate typed their password and hit approve on the MFA push. That combo gave ShinyHunters brief, view-only access to ReliaQuest’s identity dashboard, proof that if they can talk you into approving MFA, it’s game on. Here’s your move: if anyone calls about a login or MFA, hang up and contact security using our official channel yourself, directory, ticket, or helpdesk number you already know.
ReliaQuest confirmed an employee was socially engineered into entering their password on a fake SSO page and approving an MFA push, giving attackers a brief “view only” session in the company’s identity dashboard. The attackers allegedly impersonated a named member of the security team over the…
ReliaQuest said it was targeted in a ShinyHunters-linked social engineering attack that used a fake domain hosting a ReliaQuest single sign-on (SSO) phishing page. Attackers then called employees while impersonating named security staff to push victims to the fake login page, resulting in one…
Google and Reuters report a real vishing-led intrusion campaign tied to the extortion crew behind the retired “BlackFile” brand (tracked as UNC6671). Attackers call employees on personal phones spoofing the corporate IT help desk, push a same-day “passkey/MFA update,” and send them to a look‑alike…
Google says the BlackFile extortion group (UNC6671) rebranded to “Redact” while keeping the same core scam: phone calls that impersonate IT helpdesk staff and push “urgent security migrations.” Victims are directed to spoofed login pages that steal passwords and MFA codes, enabling attackers to…
UNC6671 is running real-world voice phishing (vishing) campaigns where callers impersonate IT help desk staff and create urgency around “mandatory” security changes. Victims are pushed to spoofed login pages that capture passwords and MFA codes, enabling attackers to access and steal data from SaaS…
CrowdStrike reports attackers increasingly bypass security tools by using trusted login paths, phone-based IT impersonation, and abuse of legitimate cloud and AI services. The report highlights real intrusions where vishing led to single sign-on takeovers and rapid data theft, and where attackers…
