As cited
Copy frozen at (site build).
breaches incidents
A Social Engineering Attempt Against ReliaQuest: What We Found
ReliaQuest disclosed a social engineering attack on August 22, 2026, in which threat actors registered a lookalike domain, created a fake single sign-on page, and impersonated security employees to trick employees into revealing credentials. One employee's credentials were compromised, yielding brief view-only access to the identity dashboard, but all subsequent lateral movement attempts were blocked by device trust controls and the session was terminated within hours.
Why it matters: Security teams should recognize this attack pattern (lookalike domains, impersonation calls, MFA push abuse, rapid enrollment attempts) as a persistent industry-wide tactic and evaluate whether their own device trust and zero-trust controls would similarly contain a compromised identity before attackers reach applications or data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
breaches incidents
A Social Engineering Attempt Against ReliaQuest: What We Found
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
breaches incidents
A Social Engineering Attempt Against ReliaQuest: What We Found
ReliaQuest disclosed a social engineering attack on August 22, 2026, where a threat actor used a lookalike domain and fake single sign-on page to briefly gain view-only access to an identity dashboard. The attacker’s attempts to move further were blocked by device trust and other controls, and no customer or internal systems were compromised. The incident highlights common tactics like impersonation calls, multi-factor authentication push abuse, and rapid domain setup.
Why it matters: Security teams should review defenses against phishing and multi-factor authentication abuse, as this attack demonstrates how even trained staff can be deceived and how layered controls can limit damage.
- Source published
- First seen by Cybersecurity Tracker