# The Firm That Warned About ShinyHunters Just Got Hit by Them
Four days before the breach, ReliaQuest was playing offense.
On August 17, the Tampa-based cybersecurity firm posted a thread on X flagging an active ShinyHunters phishing campaign — warning the industry about a suspicious pattern of domains using the .claims URL suffix and the group's expanding social engineering playbook. They'd been tracking it. They published indicators. They told the world to watch out.
Then ShinyHunters called their employees.
ReliaQuest confirmed the incident Monday in a blog post that reads like exactly what it is: a security company explaining how one of their own people got socially engineered despite the company actively tracking the attacker. The tweet went down. The screenshots went up on ShinyHunters' site. The taunting followed.
This isn't just embarrassing for a vendor whose entire value proposition is knowing the threat landscape better than you. It's a clinical case study in how modern credential attacks work — and why your existing controls probably aren't enough to stop them.
## How the Attack Actually Ran
Strip away the PR framing and the technical sequence is straightforward, which is exactly what makes it instructive.
The attackers registered a lookalike domain and stood up a ReliaQuest SSO phishing page — convincing enough to fool someone already on a call with a "security employee." Then they started calling ReliaQuest staff. Not a spray-and-pray operation: they impersonated a named security employee, which means they had done enough reconnaissance — LinkedIn, org charts, published content — to know who works there and in what role.
Multiple employees got the call. One didn't hang up. They navigated to the page, entered their password, and approved the push notification on their phone.
That last part matters. The attacker got both factors not by cracking anything — but by being persuasive on the phone while the victim was already looking at a fake login page. Approving an MFA push while someone is walking you through a process doesn't feel like approving a breach. It feels like doing your job.
The result: a brief authenticated session on a ReliaQuest Okta identity dashboard. View-only access. The attacker tried to pivot from there into actual applications and got blocked every time by downstream controls. No customer data accessed. No persistence established. ReliaQuest's security architecture absorbed the hit at the perimeter of the blast radius.
## "Limited Impact" Deserves Scrutiny
ReliaQuest is being transparent — notably more transparent than most firms would be in this situation. Credit where it's due: they named the attack vector, described the social engineering chain in technical terms, and didn't hide behind vague "security incident" language.
But "view-only access to an identity dashboard" isn't nothing, and it's worth sitting with that for a moment.
An Okta admin panel, even read-only, surfaces information: user directories, application assignments, group memberships, potentially configured integrations. For a threat actor doing reconnaissance on a target — or building a more convincing pretextual attack for later — that's signal. ShinyHunters is not a group that takes one swing and walks away.
The company explicitly says no additional identities were accessed and no customer data was reached. Those are meaningful claims, and there's no reason to doubt them given the specificity of the disclosure. But "limited impact" is a description of what happened, not a measure of what could have happened with a slightly longer session, slightly weaker downstream controls, or an attacker who didn't immediately escalate to bragging rights over operational patience.
## ShinyHunters Is Professionalizing
What stands out here isn't the phishing page — it's the calling campaign.
ShinyHunters built their reputation on data theft and forum activity: the 2024 Snowflake credential wave that touched Ticketmaster, Santander, and AT&T; hundreds of millions of records; a functional business model around extortion and data sales. That operation was largely opportunistic — companies without MFA on their Snowflake instances, credentials sitting exposed.
This is different. The ReliaQuest attack involved domain registration, a convincing SSO clone, phone calls impersonating named employees, and targets at a company that was actively hunting the group. ReliaQuest also noted that ShinyHunters had expanded their impersonation playbook beyond IT and help desk personas to include legal teams — a significant tell about where they think social engineering attacks succeed. Legal team impersonation triggers urgency and authority differently than IT support. It implies litigation, compliance, contracts — pressure that bypasses skepticism.
This is a group professionalizing their human attack surface. It rhymes with Scattered Spider's rise in 2022-2023, when vishing attacks against MGM and Caesars demonstrated that sophisticated social engineering could walk past technical controls that had cost millions to build.
## What Defenders Should Actually Change
Push notification MFA approval is the seam getting torn open here, and it has been for two years. The Uber breach in 2022 used the same mechanic: an attacker calling an employee, walking them through a fake IT scenario, getting them to approve an Okta push. The fix isn't to add another awareness training module. The fix is to move off push notifications entirely.
Phishing-resistant MFA — hardware security keys, passkeys, certificate-based authentication — doesn't allow approval via a phone call. There's no push to approve. The binding between the authentication and the physical origin means a fake SSO page can't complete the handshake even with a valid password in hand.
Beyond MFA: call verification protocols matter. ReliaQuest notes that multiple employees received the call. Some apparently ended it without falling for it. That variation tells you something — either training, skepticism, or verification habits made the difference for most. Formalizing that: a second channel verification step before any employee navigates to a page during a live call from IT or security.
The company.claims domain pattern is now a documented IOC. Block it. Flag registrations from that pattern in your threat intel feeds. It may be burned now, but naming conventions are habits.
---
## HackWire Analysis
The sharpest irony of this incident is that ReliaQuest was running active intelligence on ShinyHunters when the attack landed. Their August 17 post wasn't theoretical — it was current operational knowledge. And it still didn't protect the employee who got called.
That gap is the story. Not the breach itself, which by all accounts was successfully contained at a shallow depth. The real lesson is about the limits of organizational threat intelligence when the attack vector is human judgment under social pressure.
Security teams that track threat actors develop a kind of conceptual familiarity that can actually work against them. "We know ShinyHunters" becomes "we'd recognize a ShinyHunters attack." But the employee who approved that push notification wasn't ignoring threat intelligence — they were on a call with someone who knew their colleague's name, had a plausible pretext, and had them looking at a convincing SSO page. Threat intel doesn't travel well from the SOC to the moment a phone is ringing.
There's also something worth watching in how ShinyHunters handled the aftermath: immediate public taunting, screenshots posted to their own site, a deleted tweet weaponized into proof of compromise. This isn't just a crime operation — it's reputation management. Demonstrating they can hit a cybersecurity firm isn't about the access; it's a signal to future victims that paying looks better than fighting. ReliaQuest's transparency is the right move, but ShinyHunters got the headline they wanted regardless.
For defenders in the identity and detection space: your vendors are targets. A compromised identity dashboard at an MDR or MSSP is adjacent to your own infrastructure. Third-party access reviews and principle of least privilege on vendor integrations aren't optional hygiene — they're blast radius control.
The sophistication ceiling on vishing-plus-phishing attacks is going up. Organizations that haven't moved to phishing-resistant MFA are running on borrowed time.
— HackWire Editorial
---
## Related Coverage