Hackers impersonate security staff to steal credentials in ReliaQuest social engineering attack. August 24, 2026 ReliaQuest has reported a targeted social engineering attack in which threat actors impersonated company security personnel, used a spoofed domain, and successfully persuaded one employee to approve a malicious multi-factor authentication (MFA) request. Data breach prevention Discover more Endpoint security software The incident, detected on August 22, 2026, resulted in the temporary exposure of a single identity session with view-only access to ReliaQuest's identity dashboard. Fortunately, the company stated that its security controls prevented the attackers from accessing business applications, customer environments, or internal systems. ReliaQuest shares threat research materials through its Resource Center and blog channels. ReliaQuest social engineering attack. According to ReliaQuest, the campaign began with the registration of a deceptive domain that closely resembled the company's legitimate web infrastructure. The attackers set up a counterfeit ReliaQuest single sign-on (SSO) portal using a content delivery network (CDN). This technique makes phishing infrastructure more resilient and less suspicious. The threat actors then conducted phone-based social engineering, known as vishing, targeting multiple employees. During the calls, the attackers impersonated named members of ReliaQuest's security staff and directed employees to authenticate via a fraudulent SSO page. One employee entered their password into the fake portal and approved a malicious MFA push notification sent to their mobile device, granting the attackers a short-lived session within the organization's identity management environment. Discover more Data privacy consulting Information security training ReliaQuest stated that the compromised session had only view-only access to its identity dashboard. Although the attackers attempted to use this access to reach additional applications, they were blocked by the company's security controls. Data breach prevention The company credited its defense-in-depth model, which includes device-trust controls that prevent unmanaged or non-corporate devices from accessing enterprise applications and systems, for containing the incident. Incident-response actions terminated the malicious session, expired the affected password, and reset all authentication factors linked to the identity. A subsequent investigation reviewed device-trust enforcement, on-network access, identity logs, control effectiveness, and any suspicious activity from the preceding 48 hours. ReliaQuest reported no evidence of additional compromised identities, no established persistence mechanisms, and no access to customer or company data beyond the exposed login credentials. The company also denied claims that it experienced a ransomware incident or a broader compromise. This attack illustrates a common identity-focused intrusion pattern that includes quickly registering lookalike domains, delivering phishing content via CDN-backed infrastructure, impersonating employees, harvesting passwords, approving MFA prompts, and attempting to enroll a new authenticator. Discover more Crime & Justice Critical vulnerability alerts Cybersecurity consulting MFA alone does not prevent attacks when users can be manipulated into approving prompts. Organizations should pair MFA with phishing-resistant authentication methods, such as FIDO2 security keys or passkeys, enforce device posture checks, restrict authenticator enrollment, and continuously monitor identity provider sessions for anomalous activity. Security teams should also treat unexpected calls from IT or security personnel as verification events. Employees should independently confirm requests through trusted internal channels rather than following a caller's instructions or navigating to a provided login page. Data breach prevention Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world. Hot this week

ReliaQuest: how ReliaQuest stopped a ShinyHunters breach attempt. ReliaQuest Thwarts ShinyHunters Social Engineering Attack Targeting Okta SSO On 23 August 2026, cybersecurity firm ReliaQuest confirmed a social engineering attack linked to the ShinyHunters threat group, which attempted to breach its systems using a fake Okta Single Sign-On (SSO) page. The attackers, posing as IT support, tricked an employee into approving a multi-factor authentication (MFA) push during an impersonation call, granting them access to a view-only identity dashboard session. The breach was contained quickly due to ReliaQuest's layered security controls, including device-trust policies that restricted the attacker to a single session. No business applications, customer data, or company data were accessed, and no persistence was established. The compromised credentials were immediately expired and reset upon detection. The attack followed a well-documented playbook: threat actors registered a lookalike domain, hosted a fake SSO page behind a content delivery network (CDN), and used phone-based impersonation to deceive the employee. The incident mirrored a recently disclosed WordPress plugin flaw that allowed authentication bypass, reinforcing the need for defense-in-depth strategies rather than reliance on single security measures. ReliaQuest's GreyMatter platform, which integrates with Splunk, CrowdStrike, Fortinet, and Google Cloud Chronicle, played a key role in normalizing telemetry data and enabling rapid response. The company emphasized that phishing remains effective, particularly when attackers leverage employee names and urgency to manipulate victims. A week prior, ReliaQuest's threat research team had shared intelligence on ShinyHunters, highlighting the group's use of fake domains and MFA bypass techniques. The screenshots of the compromised Okta dashboard, initially posted on X (formerly Twitter), were later deleted. The incident underscores the growing sophistication of social engineering attacks, even against cybersecurity providers. "id": "REL1787660926", "linkid": "reliaquest", "type": "Cyber Attack", "date": "8/2026", "severity": "25", "impact": "1", "explanation": "Attack without any consequences" {'affected_entities': [{'customers_affected': 'None', 'industry': 'Cybersecurity', 'name': 'ReliaQuest', 'type': 'Cybersecurity Firm'}], 'attack_vector': 'Fake Okta SSO page, MFA push manipulation, phone-based ' 'impersonation', 'data_breach': {'data_exfiltration': 'No', 'personally_identifiable_information': 'No', 'type_of_data_compromised': 'None'}, 'date_detected': '2026-08-23', 'date_publicly_disclosed': '2026-08-23', 'date_resolved': '2026-08-23', 'description': 'On 23 August 2026, cybersecurity firm ReliaQuest confirmed a ' 'social engineering attack linked to the ShinyHunters threat ' 'group, which attempted to breach its systems using a fake ' 'Okta Single Sign-On (SSO) page. The attackers, posing as IT ' 'support, tricked an employee into approving a multi-factor ' 'authentication (MFA) push during an impersonation call, ' 'granting them access to a view-only identity dashboard ' 'session. The breach was contained quickly due to ReliaQuest's ' 'layered security controls, including device-trust policies ' 'that restricted the attacker to a single session. No business ' 'applications, customer data, or company data were accessed, ' 'and no persistence was established. The compromised ' 'credentials were immediately expired and reset upon ' 'detection.', 'impact': {'data_compromised': 'None', 'operational_impact': 'Minimal (contained quickly)', 'systems_affected': 'Okta identity dashboard (view-only session)'}, 'initial_access_broker': {'backdoors_established': 'No', 'entry_point': 'Fake Okta SSO page, lookalike ' 'domain'}, 'investigation_status': 'Contained and resolved', 'lessons_learned': 'The incident underscores the growing sophistication of ' 'social engineering attacks, even against cybersecurity ' 'providers. Defense-in-depth strategies are critical, and ' 'phishing remains effective when attackers leverage ' 'employee names and urgency.', 'post_incident_analysis': {'corrective_actions': 'Credential reset, ' 'device-trust policies ' 'enforcement, enhanced ' 'monitoring', 'root_causes': 'Social engineering (MFA push ' 'manipulation), fake Okta SSO page, ' 'phone-based impersonation'}, 'recommendations': 'Implement layered security controls, enforce device-trust ' 'policies, and educate employees on social engineering ' 'tactics.', 'references': [{'source': 'ReliaQuest Threat Research Team'}, {'source': 'X (formerly Twitter)'}], 'response': {'containment_measures': 'Device-trust policies, credential ' 'expiration and reset', 'enhanced_monitoring': 'GreyMatter platform integration with ' 'Splunk, CrowdStrike, Fortinet, and ' 'Google Cloud Chronicle', 'incident_response_plan_activated': 'Yes', 'remediation_measures': 'Compromised credentials expired and ' 'reset'}, 'threat_actor': 'ShinyHunters', 'title': 'ReliaQuest Thwarts ShinyHunters Social Engineering Attack Targeting ' 'Okta SSO', 'type': 'Social Engineering', 'vulnerability_exploited': 'Human vulnerability (social engineering), ' 'potential WordPress plugin flaw (authentication ' 'bypass)'} Published by Cybersecurity Gaps Expose Australia's Transport and Logistics Sector Australia's transport and logistics industry a critical backbone for supply... Aug 25, 2026 Sotheby's International Investigates Cybersecurity Incident Involving Client Data Luxury real estate firm Sotheby's International is probing a cybersecurity... Aug 25, 2026 Historic McQuay Farmhouse Preserved Amid Charlotte's Growth; Preferred Parking Reports Data Breach Charlotte's Historic McQuay Farmhouse Stands as... Aug 24, 2026

ReliaQuest launches GreyMatter SIEM-Less, giving security teams detection speed and data optionality to outpace modern threats. The new capability normalizes data, runs detections in motion, gives teams full control over where data lives, and enables queries from anywhere - without the cost and rigidity of a traditional SIEM. Jul 28, 2026 Prev Next 1 of 43,499 ReliaQuest, the global leader in Agentic AI cybersecurity, announced GreyMatter SIEM-Less, a new solution built for what enterprise security teams need now: faster detection and the flexibility to store their data in a more cost-effective tool they own, query it from anywhere in seconds and create reports as needed - without the cost and rigidity of a traditional SIEM. ReliaQuest will showcase GreyMatter SIEM-Less at Black Hat USA 2026. As AI enables adversaries to move faster and with data living in more places than ever, security teams are rethinking how they operate - how data moves, where it lives, how detections run, and how quickly they can take action. They need an architecture that delivers speed of detection before data is stored, full flexibility over their telemetry, and the ability to query from a single place regardless of the underlying infrastructure. GreyMatter SIEM-Less was built to meet that need. GreyMatter serves as the Agentic Defense for the enterprise, enabling defenders to detect threats, investigate, hunt, and respond across their entire tech stack. GreyMatter SIEM-Less builds on those capabilities by modernizing how security telemetry is handled end-to-end. This approach enables detections to run in seconds while preserving the outcomes security teams rely on - search, investigations, reporting, and response - with greater flexibility and lower cost. "We are in the middle of the great re-architecture of cybersecurity," said Brian Murphy, founder and CEO of ReliaQuest. "The most advanced security teams are rethinking how they store data, how they detect threats, and how quickly they can take action to stay ahead of agentic attacks. GreyMatter SIEM-Less provides the optionality and modularity they need to build the fastest, most accurate and cost-efficient architecture possible." As the security market undergoes this major shift, teams are looking for more flexible ways to manage telemetry at scale. SIEMs have long sat at the center of security operations, but that approach requires data to be sent, indexed, parsed, and stored before any detection can run, causing latency. As data has grown more distributed, centralizing everything in a single platform has become increasingly difficult to justify on cost or speed. Security teams need to detect threats at the source or in transit, route and drop data they don't need, and retain the functionality they rely on, such as saved searches, reporting, investigations, and long-term storage, without the cost that has often come with it. Security teams can interface with stored telemetry directly from GreyMatter using natural language, such as run searches, save searches, build reports, and conduct investigations and hunts, while preserving response actions from the same console (e.g., block an IP, ban a hash, and execute containment). The result is a more comprehensive defense model that unifies data movement, detection, investigation, and response without speed and cost tradeoffs.