ShinyHunters Attempt to Compromise ReliaQuest Okta SSO via Vishing and AiTM Phishing

In August 2026, the ShinyHunters threat group executed a hybrid social engineering campaign targeting ReliaQuest’s Okta Single Sign-On (SSO) infrastructure. The attackers combined voice phishing (vishing) via spoofed IT support numbers with Adversary-in-the-Middle (AiTM) phishing proxies to intercept authentication tokens. By deploying reverse proxy domains such as okta-reliaquest-secure(.net), the actors attempted to capture Set-Cookie: sid= and Authorization: Bearer headers in real-time. Although 12 test credentials were intercepted, ReliaQuest’s SIEM/UEBA detection and MFA anomaly monitoring neutralized the threat within 15 minutes. No customer data was exfiltrated, and all compromised accounts were immediately invalidated.

• Attack Methodology: Hybrid Social Engineering

  • Vishing Component: Attackers utilized spoofed VoIP numbers to impersonate internal IT support, employing scripts designed to solicit OTPs or MFA push approvals.
  • AiTM Phishing: Deployment of reverse proxy-based landing pages to facilitate real-time interception of traffic between victims and legitimate Okta services.
  • Phishing Kits: Execution of specialized phishing kits (File Hash: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08) to automate the harvesting of session cookies.

• Technical Indicators and Artifacts

  • Malicious Domains: okta-reliaquest-secure(.net), reliaquest-okta-login(.org), and secure-okta-reliaquest(.info).
  • Network Infrastructure: AiTM proxy identified at IP 185.199.108.153; vishing VoIP gateway identified at 45.76.12.34.
  • Targeted Tokens: Interception of Set-Cookie: sid= and Authorization: Bearer headers via TLS-encrypted AiTM relays.

• Threat Actor Tactics (MITRE ATT&CK)

  • T1566.002 & T1566.003: Combined spearphishing links with high-fidelity voice phishing (vishing) to circumvent perimeter identity defenses.
  • T1090.003: Utilization of multi-hop proxies to obfuscate the origin of the AiTM infrastructure.
  • T1562.001: Attempted to impair defenses by manipulating user authentication workflows via social engineering.

• Impact and Incident Response

  • Compromised Assets: Approximately 12 test Okta credentials were captured but immediately invalidated through forced resets.
  • Data Exfiltration: Zero confirmed instances of customer or internal data theft or unauthorized system access.
  • Response Efficacy: ReliaQuest SIEM UEBA anomalies and MFA alerts enabled a successful block within 15 minutes of the campaign launch.

• Remediation and Defense-in-Depth

  • MFA Hardening: Prioritizing phishing-resistant authentication (e.g., FIDO2/WebAuthn) to negate AiTM session hijacking.
  • Enhanced Detection: Implementation of real-time anomaly scoring for all authentication events and updated SEG rules for AiTM proxy patterns.
  • Human Layer Defense: Targeted training modules addressing high-fidelity social engineering and IT impersonation tactics.