ShinyHunters phished the firm that had just profiled it, and device trust was the only thing that mattered
A ReliaQuest employee gave up a password and an MFA push five days after the company named the .claims campaign. Device trust, not training, kept the session worthless.
The Watch · Security desk
What happened
- On August 17 ReliaQuest publicly flagged a ShinyHunters campaign registering domains that place a target company's name under the .claims top-level domain.
- On August 22 a caller impersonating a named ReliaQuest security employee got one teammate to enter a password on a fake SSO page and approve the MFA push.
- ReliaQuest says the resulting access was view only, with no applications or systems reached and no customer data touched.
- SOCRadar reports that a listing naming ReliaQuest went up on a ShinyHunters-linked leak site on August 23, carrying Okta screenshots.
- ReliaQuest calls claims that it was compromised or hit by ransomware false.
Why it matters
- What it limits constraint Awareness training has no headroom left as the control of record: the vendor's own position is that well-trained people lose to a caller who knows a colleague's name, so the only remaining...
- Who has to decide decision The push factor was satisfied and still bought the defender nothing, which moves the design and procurement question to whether an unmanaged device can open anything at all after a valid sign-in.
- Who's exposed exposure A phished analyst identity at a managed detection provider sits adjacent to other companies' environments, which gives the vendor's own identity provider leverage well beyond its own network.
- What doesn't add up contradiction Attacker and victim describe the same limits on the access in the same words, so the leak-site entry reads as reputational pressure rather than evidence, and SOCRadar treats it that way.
Next story · Security · 3d ago
Phase Eight, Hobbs and Whistles owner discloses a cyber incident a week after AsosConfirmed9 publishers
BleepingComputer put the lookalike host at reliaquest.claims [10]. That is the pattern ReliaQuest itself had published five days earlier, the target's name or abbreviation under the .claims TLD [5][23], which means the indicator already existed inside the company that then walked into it. The gap was not intelligence. It was that a phone call using a real colleague's name is sufficient [2].
The push notification was approved, so the second factor did exactly what it was built to do and bought nothing [2]. What mattered afterwards was device binding: ReliaQuest says a non-ReliaQuest device cannot reach any application or system, valid credential or not [13]. Its write-up is unusually plain about starting from the assumption that someone will eventually be phished [14]. Containment then followed the identity rather than the endpoint, with sessions terminated, the password expired and every authentication factor reset [16], plus an audit reaching back to August 21 that turned up nothing further [18].
View-only is not harmless. The attacker kept trying to open applications from the dashboard [4], which tells you the session was functioning as a list of what was worth attempting [24]. Nobody has said how many staff were called [2]. The number that actually describes the outcome is how many business applications a valid credential opened from an untrusted device, and on ReliaQuest's account that was zero [22].
Then the strange part. The group listed the company on August 23 with screenshots that appear to show an Okta SSO account [9][11] and a message telling ReliaQuest to leave reporting on it to Mandiant [12]. Speaking to BleepingComputer, ShinyHunters described its own access in the same terms as its victim did [15], in wording identical to the sentence ReliaQuest published [21]. SOCRadar's assessment is that the public taunting does not substantiate the breach claim or demonstrate access to ReliaQuest networks [20]. When the extortion post and the incident report agree on the blast radius, the thing on sale is embarrassment, which is why the firm's denial is aimed at the words compromise and ransomware [19].
The asymmetry is worth naming. The same call, the same entered password and the same approved push, at an organization where the identity provider is effectively the front door, ends in notification letters rather than a blog post. ReliaQuest could publish because the answer to what the session reached was small enough to publish [3].
What to watch
- Whether ShinyHunters posts anything drawn from the session itself rather than screenshots of the Okta dashboard.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+25
- Incentives70
- Confidence62
Perspective Coverage
5 publishers- Builder
- Builder 29%
- Operator
- Operator 56%
- Investor
- Investor 15%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
ReliaQuest confirmed that one of its own employees fell for a social engineering attack, handing attackers a password and a brief window into the company's identity system.
- [2]
According to ReliaQuest's write-up, it was targeted by a social engineering attack on August 22: the actor called multiple teammates, each time posing as a security employee by name, and one teammate entered their password and approved the push notification on their phone, handing the attacker a brief session on the identity dashboard.
- [3]
ReliaQuest said the extent of the access was view only, that no ReliaQuest applications or systems were accessed, and that no customer data was ever touched.
- [4]
ReliaQuest said the threat actor continued with attempts to access applications from the dashboard but was consistently denied due to the security controls in place.
- [5]
On August 17 ReliaQuest's Threat Research team posted on X that it was tracking a widespread ShinyHunters campaign using domains following the company[.]claims pattern, incorporating the targeted organization's name or abbreviation under the .claims TLD.
- [6]
ReliaQuest warned that the group had been expanding its social engineering tactics to include legal team impersonation alongside IT and help desk impersonation.
- [7]
The @odysseusgroup account replied to ReliaQuest's post with screenshots and the message "Who's hunting who?"; those posts have since been deleted.
- [8]
ReliaQuest said the threat actor registered a lookalike domain and stood up a fake ReliaQuest single sign-on page behind a content delivery network.
- [9]
According to SOCRadar, a listing naming ReliaQuest appeared on a ShinyHunters-associated leak site on August 23.
- [10]
BleepingComputer found the lookalike domain used to host the phishing page to be reliaquest.claims.
- [11]
The leak site post carried screenshots that appear to show access to a ReliaQuest Okta SSO account.
- [12]
The message on the group's leak site read: "This time the post is about you, not us. Let Mandiant report and advise on us accurately, go away."
- [13]
ReliaQuest said its controls include device trust, which prevents non-ReliaQuest devices from accessing any application or systems, and that it does not treat a sign-in to its identity provider as permission to do anything at all.
- [14]
ReliaQuest wrote: "Our defense in depth starts from the assumption that a threat actor will eventually phish someone's account. Phishing works. Even well-trained people can be deceived by a convincing caller who knows a teammate's name."
- [15]
ShinyHunters told BleepingComputer that their access was view only and did not reach any applications, systems or customer data, saying: "No additional identities were accessed, no business applications were reached, no customer or ReliaQuest data was accessed beyond the user's login credentials, and no persistence was established."
- [16]
ReliaQuest said containment actions terminated the attacker's sessions, expired the password and reset every authentication factor.
- [17]
ReliaQuest stated: "No additional identities were accessed, no business applications were reached, no customer or ReliaQuest data was accessed beyond the user's login credentials, and no persistence was established."
- [18]
ReliaQuest audited its control fidelity, device trust and on-network access since August 21 and identified no suspicious activity.
- [19]
ReliaQuest stated: "Claims that ReliaQuest was compromised or targeted by ransomware are false."
- [20]
SOCRadar said of the ShinyHunters posts: "These exchanges illustrate the actor's pressure tactics and public taunting, but they do not substantiate the breach claim or demonstrate access to ReliaQuest networks."
- [21]
The description of the access that BleepingComputer attributes to the threat actor is word-for-word the sentence ReliaQuest published in its own account.
- [22]
On ReliaQuest's account, the number of business applications reached from the phished identity was zero.
- [23]
Five days separated ReliaQuest's public warning about the .claims campaign and the call that phished its own employee.
- [24]
The attacker's repeated application-access attempts launched from the dashboard indicate the view-only session enumerated applications available to try.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comReliaQuest confirms failed data-theft attack after ShinyHunters breach
1 article · August 24, 2026
- helpnetsecurity.comShinyHunters taunts ReliaQuest after its own employee falls for social engineering attack
1 article · August 25, 2026
- infosecurity-magazine.comReliaQuest Rejects Compromise Claims After ShinyHunters Incident
1 article · August 25, 2026
- scworld.comShinyHunters claims social engineering attack against ReliaQuest
1 article · August 24, 2026
- securityweek.comReliaQuest Confirms ShinyHunters Hack, but Says Impact Was Limited
1 article · August 24, 2026