Editor’s note: This report was authored by Daniel Wroblewski.
This is external threat intelligence from the ReliaQuest Threat Research team. The findings describe threats, vulnerabilities, and attacker activity affecting third parties and the broader threat landscape—not ReliaQuest's own environment. Nothing in this report should be interpreted as a vulnerability in ReliaQuest's systems or data.
Key Points
Attackers are routing authentication and device registration through residential proxies near each victim's expected location. This helps malicious sessions evade geographic-anomaly detections and risky-user signals.
These attacks are cheap, simple, and repeatable. They require no malware or software exploits. Social engineering provides a valid identity, while built-in software-as-a-service (SaaS) APIs handle enumeration and data theft. This low barrier has helped this activity spread throughout 2026.
Actions on objectives can begin within six minutes of initial access. Phishing-resistant MFA and managed-device policies can prevent access, while GreyMatter Transit detections and Automated Response Playbooks can identify and contain malicious activity before or during exfiltration.
ReliaQuest has observed attackers combine their usual social-engineering tactics with “residential proxies”—services that route internet traffic through real home internet connections, which attackers can pick to match the victim’s location. By making their login attempts look like they're coming from the same area as the real user, attackers can slip past security systems that would normally flag suspicious activity, like logins from unexpected locations or “impossible travel” (e.g., logging in from two countries within minutes). This lets malicious sign-ins and device registrations blend in and look routine, instead of raising red flags.
Using proxies that match the victim's location is a new twist on a social-engineering attack pattern that's been showing up throughout 2026, and it's one that’s fairly easy for attackers to repeat. They don't need malware, an unknown software vulnerability, special network access, or any advanced custom-built tools to do it. A phone number, a believable pretext, an inexpensive impersonation domain, and a residential proxy can be enough to steal a valid identity. This low barrier allows groups like “ShinyHunters” and related clusters to use the same playbook against multiple organizations at once.
The campaign's infrastructure reflects how easy the attack is to carry out. Since March 2026, ReliaQuest has identified and blocked over 350 related impersonation domains. Monthly totals rose from 5 in March to almost 100 during the first three weeks of October. ReliaQuest blocked more than 50 domains during one seven-day period in mid-October. Many used passkey, single sign-on (SSO), Okta, or enrollment themes and were weaponized within hours of registration. The consistency and speed of domain creation suggest automated templating or possible use of generative AI, although this is unconfirmed.
Defenders should no longer treat familiar geography as evidence that a sign-in is legitimate. Require phishing-resistant MFA and managed devices for sensitive software-as-a-service (SaaS) applications, and use Conditional Access to block untrusted devices before a stolen identity becomes a data breach.
What ReliaQuest Found in Recent Incidents
Why Location-Based Alerts Stay Quiet
Recent incidents show that victim-matched residential proxies are making location-based identity signals less reliable. Attackers route authentication and device registration through residential IP addresses near the legitimate user's city or region. This may help attackers avoid geographic-anomaly and impossible-travel detections by making the session appear local.
Earlier campaigns relied more heavily on commercial VPNs and hosting infrastructure that defenders could identify through autonomous system numbers (ASN) reputation and known abuse patterns. Residential proxies remove much of that signal. When the source IP address has no established malicious reputation and its location matches the user’s expected activity, the sign-in becomes harder to tell apart from a legitimate one.
Actions on Objectives Can Begin Within Minutes
The clean-looking authentication is only the beginning of the attack. Once attackers establish access, they can move directly to their objective: discovering, accessing, and stealing sensitive data for extortion. In one incident, suspected exfiltration activity began approximately six minutes after initial access. In another, it began about 15 minutes after initial access.
Exfiltration does not always produce a clear file-download event. In cloud environments, attackers can use Microsoft Graph and other built-in SaaS application programming interfaces (APIs) to enumerate, open, preview, synchronize, or otherwise retrieve file content. As a result, large-scale file-access activity—particularly when it involves automated clients, unusual access sequences, or hundreds of sites—should be treated as potential exfiltration even when logs do not explicitly classify the activity as a download.
ReliaQuest has observed incidents in which files appeared on data-leak sites despite the available telemetry containing file-access events but no corresponding file-download events. This gap can result from differences in SaaS audit logging, API behavior, synchronization methods, or incomplete outbound visibility. Defenders should therefore avoid requiring a conventional download event before escalating suspected data theft.
In incidents involving SharePoint, Microsoft Graph API clients generated tens of thousands of file-access events across hundreds of sites. In another incident, an attacker scanned more than 23 billion database rows and extracted approximately 136GB during a 14-hour automated query session. These patterns show what actions on objectives can look like in practice: rapid enumeration, broad file access, automated API activity, and sustained access to unusually large volumes of data.
The compressed timeline also makes delayed, SIEM-dependent detection less effective on its own. Controls that prevent access from untrusted devices, GreyMatter Transit detections that identify the activity as it occurs, and GreyMatter Automated Response Playbooks that immediately revoke access can interrupt the attack before or during exfiltration.
How One Identity Fuels Extortion
One compromised identity can expose multiple cloud environments and provide enough data to support extortion. Through single sign-on, one account may reach SharePoint, email, Salesforce, analytics platforms, and sandbox environments. Disabling the user in one application doesn’t always revoke access in connected systems.
Attackers have claimed possession of hundreds of thousands of files, tens of thousands of email items, and millions of database records. Observed data included customer engagement records, financial information, employee credentials, and business-critical documents across multiple subsidiaries.
Stolen data gives attackers specific information they can use as leverage. Extortion messages cite internal files, client relationships, and sensitive business information before imposing short payment deadlines. Attackers threaten to publish the data or sell it if the organization refuses to pay.
Limited telemetry can leave organizations unable to confirm the full scope of exfiltration. In several incidents, available audit and outbound visibility did not show exactly what left the environment. ReliaQuest has also observed cases in which file-access events were present without corresponding download events, but the affected files later appeared on data-leak sites. Security teams, legal counsel, and insurers may therefore need to make notification and containment decisions without a single definitive exfiltration event.
How the Attack Works: From Phone Call to Data Theft
These attacks begin with calls, SMS messages, or external collaboration requests to employees. Attackers impersonate IT help-desk staff, HR, or legal personnel and direct victims to fake identity, passkey, or enrollment pages.
Because these interactions often occur by phone or through collaboration platforms rather than email, the initial lure may not be visible to the security team. The first observable event may be a sign-in or device registration that appears consistent with the user’s normal location.
After capturing credentials or session tokens, the attacker routes authentication and device registration through a residential proxy near the victim’s expected location. The attacker may then register a device or authentication method that creates a persistent access path and survives a password reset.
Initial access is not the attacker’s final objective. The compromised identity provides access to connected cloud applications, where the attacker can rapidly enumerate repositories, access files, query databases, and retrieve email or customer records through built-in SaaS APIs. At this stage, defenders may see high-volume file access, unusual Microsoft Graph activity, access across hundreds of sites, or automated queries rather than traditional malware or clearly labeled download events.
The stolen information is then used for extortion. Attackers may cite internal documents, customer relationships, financial information, or employee data to prove possession before threatening publication or sale.
Step Up Your Defenses
ReliaQuest’s Approach
In these incidents, attackers moved from a clean-looking authentication to data access in as little as six minutes. Their activity used valid identities and built-in SaaS APIs, while victim-matched residential proxies reduced the value of geographic and IP-reputation signals. Exfiltration also did not always appear as an explicit file-download event: In some intrusions, telemetry showed file access without corresponding downloads, but the accessed files later appeared on data-leak sites. GreyMatter addresses both the speed of the activity and this visibility gap.
Detection at Source: Identity providers and SaaS applications contain the most complete records of authentication changes, device registration, Microsoft Graph activity, and file access. Detecting at the source puts this activity in front of analysts even when the available telemetry records file access, previews, synchronization, or API retrieval rather than an explicit download. Correlating these events helps identify actions on objectives before data theft is independently confirmed.
Detection in Transit: GreyMatter Transit identifies threats in seconds as telemetry moves from source to storage, rather than waiting until it lands in the SIEM. This allows detection and response to keep pace when attackers begin SaaS enumeration, bulk file access, or automated retrieval within minutes of initial access.
Identity and SaaS Correlation: GreyMatter connects identity events—such as password resets, MFA enrollment, authentication-method changes, and device registration—to the SaaS activity that follows. Sequences involving rapid Microsoft Graph access, cross-site enumeration, unusual file access, or bulk retrieval receive greater priority than an isolated geographic anomaly.
ReliaQuest Detection Rules are continuously updated using the latest relevant threat intelligence. Pairing these detections with GreyMatter Automated Response Playbooks helps organizations cut mean time to contain (MTTC) threats to five minutes or less. For this campaign, the combined coverage targets both the identity activity used to establish access and the actions-on-objectives activity associated with data discovery and exfiltration.
How ReliaQuest Helps You Stay Ahead
The following ReliaQuest detection rules target behaviors observed in this campaign:
Detection Rule | MITRE ATT&CK ID | Summary |
|---|---|---|
Device Registration With Suspicious User Agent (005146) | TA0003: T1098.005 - Device Registration | Detects attacker device enrollment using QEMU or other virtualized user agents |
Mass File Downloads from File Share with Suspicious User Agent (004989) | TA0009: T1039 - Data from Network Shared Drive | Detects high-volume file downloads through suspicious or automated clients |
Device Registration Followed by Login Via Suspicious User Agent (005083) | TA0001: T1078 - Valid Accounts | Flags device enrollment immediately followed by cloud application access |
Suspicious External Teams Chat Name (004028) | TA0001: T1566 - Phishing | Identifies Teams-based social engineering from external tenants using IT-themed display names |
Authentication Attempt with Malicious User Agent (004203) | TA0004: T1078.004 - Cloud Accounts | Detects authentication using known malicious user agents |
GreyMatter Automated Response Playbooks respond when the above detection rules fire:
Disable User + Terminate Sessions: Immediately cuts authenticated access when a compromised identity is confirmed.
Remove All Authentication Methods + Delete Device: Eliminates attacker-registered MFA methods and rogue devices that survive password resets.
Isolate Host: Contains compromised endpoints if the attacker has moved beyond identity-only access.
Block IP + Block Domain: Blocks attacker infrastructure including credential-harvesting domains and proxy endpoints.
Your Action Plan
Require phishing-resistant MFA. Enforce FIDO2 security keys or platform-bound passkeys for all workforce users and administrators. Retire SMS, push-to-approve, and time-based one-time password (TOTP) methods where possible. These methods remain vulnerable to social engineering and adversary-in-the-middle (AiTM) phishing.
Restrict sensitive SaaS access to managed devices. Use Conditional Access to require managed, compliant devices for email, identity, and sensitive cloud applications. This reduces reliance on geographic and IP-reputation signals that residential proxies can evade.
Harden help-desk and account-recovery workflows. Require out-of-band identity verification before password resets, MFA enrollment, or account unlocks. Use callback procedures with known contact information rather than details provided during the request.
Disrupt impersonation infrastructure and lures. Block newly registered, unknown, and domains that imitate your organization at the web gateway and DNS layer. Train employees to verify unexpected IT, HR, or legal requests through established internal channels.
Connect identity changes to rapid data access. Alert when password resets, MFA enrollment, or device registration are followed by Microsoft Graph activity, SaaS enumeration, or bulk downloads. Give these sequences higher priority than isolated geographic anomalies.
Remove every access path during containment. Revoke active sessions and OAuth tokens, then remove unauthorized authentication methods and registered devices. Disable corresponding accounts in federated applications and sandboxes before returning the identity to service.
Key Takeaways and What's Next
Expect This Playbook to Keep Spreading
This attack chain doesn’t require malware, a zero-day vulnerability, or advanced infrastructure. The tooling is repeatable, and attackers can target multiple organizations concurrently by changing the impersonation domains. We assess with high confidence that these groups will keep up their current pace over the next one to three months.
Clean-Looking Sign-ins Are the New Normal
Residential proxies are making malicious sessions blend into normal user activity. Earlier campaigns used commercial VPNs and hosting ASNs that defenders could flag. The current approach makes the initial authentication look clean. Organizations without device-trust requirements and phishing-resistant MFA will have fewer chances to stop these incidents before exfiltration.
Prevention and Real-Time Response Get in Front of the Attack
When actions on objectives begin within 6 to 15 minutes of initial access, organizations cannot rely solely on logs reaching the SIEM, triggering detection logic, and waiting for analyst review. The speed of the attack makes preventive policy enforcement and real-time response more important—not response impossible.
Conditional Access, managed-device requirements, and phishing-resistant MFA can prevent the attacker from establishing a usable session. If access succeeds, GreyMatter Transit visibility and SIEM-less detections can identify suspicious identity and SaaS activity as it occurs. GreyMatter Automated Response Playbooks can then terminate sessions, revoke tokens, disable identities, and remove attacker persistence before or during exfiltration.
This layered approach provides opportunities to stop the intrusion at multiple points: before access, immediately after unauthorized device registration, during cloud discovery, or while the attacker is attempting to retrieve data. ReliaQuest continues to monitor this activity and update preventive, detection, hunting, and automated-response coverage as the tradecraft evolves.
