techjacksolutions.com • 1h
ShinyHunters Attempt to Compromise ReliaQuest Okta SSO via Vishing and AiTM Phishing
In August 2026, the ShinyHunters threat group executed a hybrid social engineering campaign targeting ReliaQuest’s Okta Single Sign-On (SSO) infrastructure. The attackers combined voice phishing (vishing) via spoofed IT support numbers with Adversary-in-the-Middle (AiTM) phishing proxies to intercept authentication tokens. By deploying reverse proxy domains such as okta-reliaquest-secure(.net), the actors attempted to capture Set-Cookie: sid= and Authorization: Bearer headers in real-time. Although 12 test credentials were intercepted, ReliaQuest’s SIEM/UEBA detection and MFA anomaly monitoring neutralized the threat within 15 minutes. No customer data was exfiltrated, and all compromised accounts were immediately invalidated.