ReliaQuest Thwarts Social Engineering Attack Using Fake SSO and MFA Push Abuse

ReliaQuest detected and contained a targeted social-engineering campaign (Aug 22, 2026) where attackers registered a lookalike domain, hosted a counterfeit SSO page behind a CDN, and used phone-based impersonation plus an MFA push to gain a short-lived, view-only session on one employee account; device-trust controls and rapid containment prevented access to business applications, customer data, or persistence.