As cited
Copy frozen at (site build).
threat intel
Residential Proxies Mask Social-Engineering Attacks
Attackers are using residential proxies to route authentication and device registration through IP addresses near victims' expected locations, allowing malicious sessions to evade geographic-anomaly detections and appear legitimate. Once authenticated, compromised identities enable rapid data enumeration and exfiltration through built-in SaaS APIs, with actions on objectives beginning within 6 to 15 minutes of initial access. This low-cost, repeatable technique requires only social engineering and does not depend on malware or software exploits.
Why it matters: Security teams must treat location-based identity signals as unreliable and implement phishing-resistant multifactor authentication (MFA), managed-device policies, and real-time identity and SaaS correlation detection to prevent or quickly interrupt attacks that compress the timeline from compromise to data theft to under 15 minutes.
- Source published
- First seen by Cybersecurity Tracker