Hackers Impersonate Security Staff to Steal Credentials in ReliaQuest Social Engineering Attack

ReliaQuest reported a targeted social-engineering campaign on August 22, 2026 in which attackers registered a lookalike domain, hosted a fake SSO portal via a CDN, and used vishing to coerce an employee into entering credentials and approving a malicious MFA push, resulting in a short-lived, view-only identity session; defensive controls and incident response prevented access to applications or data and no further compromise was found.