A Social Engineering Attempt Against ReliaQuest: What We Found

On August 22, 2026 ReliaQuest was targeted by a social‑engineering campaign that used a throwaway lookalike domain, a fake SSO page behind a CDN, and impersonation calls to harvest credentials and abuse MFA push; one teammate approved a push, granting the attacker a brief, view‑only session to the identity dashboard. Containment actions (device trust, session termination, password expiry, and authenticator resets) prevented further access, no applications or customer data were accessed, and investigation found no persistence; the playbook aligns with an industry pattern of MFA push abuse and short‑lived harvesting domains.