ReliaQuest sells detection and response. Over the weekend before 24 August 2026, it became the story instead of covering one.

The group ShinyHunters registered a domain hosting a fake ReliaQuest single sign-on page, then telephoned multiple ReliaQuest employees. On each call the attacker posed as a named security employee and directed the target to the fraudulent site.

One employee entered their credentials and approved a push notification.

What the attackers got

Per ReliaQuest: view-only access to its Okta identity dashboard, and one user's login credentials.

The company says attempts to move from there into applications were consistently denied. It states that no additional identities were accessed, no business applications were reached, no customer or company data was accessed beyond those login credentials, and no persistence was established. It calls claims of ransomware involvement false.

ShinyHunters posted screenshots said to show the Okta dashboard, with taunting messages.

Read the controls, not the embarrassment

The obvious take is that a security company got phished. It did, and it is not a good look.

The more useful read is that this incident splits cleanly into a control that failed and a set that held, and the split is instructive for anyone running the same stack.

What failed: the human check, and MFA. A push notification is an approval prompt, and a person who has just typed their password into what they believe is their own login page will approve the push that follows. Push-based MFA is not a defence against a live relay — it is a defence against a stolen password used later, which is a different attack.

What held: authorisation. Getting one identity did not get applications. Whatever ReliaQuest has behind Okta — conditional access, device posture, per-application policy — refused the attacker at every door. That is the control that turned a compromised employee into a screenshot rather than an incident.

Blast-radius containment is unglamorous and it is what worked here.

The technique is the trend

Calling people is back, and it works because it inverts the training.

Employees are drilled to distrust unexpected email. A phone call from a colleague whose name is real — who knows the internal team structure well enough to pick one — arrives through a channel most awareness programmes barely cover. It also creates time pressure that email cannot: someone is waiting on the line.

That the caller used real employees' names is the operationally significant detail. It means reconnaissance preceded the calls, and staff directories, LinkedIn, or a prior data set were enough to build a credible script.

We have written this month about attacks that remove a defender's visibility — an implant that unlinks EDR callbacks in the Windows kernel, a Defender driver that can delete Defender at boot. This is the low-technology member of the same family. Nothing is bypassed. A person is asked, and says yes.

The deleted post

ReliaQuest's original post on X warning about the phishing campaign was later deleted.

We do not know why, and there are ordinary reasons — a legal review, a correction, an incident-communications process taking over from an individual. It is recorded here because it is a fact of the public record, not because it implies anything. Where a company's own timeline of disclosure matters to readers, it is worth noting that part of it is no longer visible.

What to do

  • Treat inbound calls claiming to be internal staff as unauthenticated. Hang up, call back on a number from your own directory. This is the single control that defeats the whole technique.
  • Move the accounts that matter off push approval. Phishing-resistant MFA — passkeys, FIDO2 security keys — does not relay, because the credential is bound to the real domain. Push and one-time codes both do.
  • Assume one identity will fall. ReliaQuest's outcome was decided by what sat behind Okta, not by whether anyone clicked.
  • Watch for newly registered look-alike domains of your own SSO. That registration was the first observable step here.
  • Rehearse the call. Staff who have heard the pretext once are dramatically harder to run it on.

What is not established

  • How many employees were called, or how many resisted before one did not.
  • How the attackers built their list of names.
  • The exact dates of the calls beyond the weekend before the 24 August statement.
  • Whether ShinyHunters' screenshots show anything beyond what ReliaQuest describes. The company's account and the attackers' claims disagree, and only one side has been independently checked — which is to say neither.