ShinyHunters Claimed It Broke Into ReliaQuest. The Reality Is More Complicated.
A cybersecurity company's own employee fell for a fake login page, handing criminals limited access. What happened next is actually a story about defences holding.
Key points
- ShinyHunters, a criminal hacking group, claimed it broke into cybersecurity firm ReliaQuest and posted screenshots as proof.
- A ReliaQuest employee was tricked into entering their login credentials on a fake sign-in page, giving criminals read-only access to one portal.
- ReliaQuest says every attempt by the criminals to access sensitive systems or move deeper into its network was blocked.
- Palo Alto Networks' Unit 42 research team found that 97% of AI-written malware samples they analysed never appeared in real-world attacks.
- Two alleged members of the cybercriminal gang TeamPCP were identified and arrested.
A hacking group called ShinyHunters spent last week taunting a cybersecurity company on social media. ReliaQuest had warned the public about a ShinyHunters phishing campaign, where criminals send fake messages to steal passwords. ShinyHunters replied on X with "Who's hunting who?" and attached screenshots appearing to show access to a ReliaQuest employee's Okta account. Okta is a widely used login-management service that lets staff sign into many work tools with a single password.
We covered the initial vishing call on 24 August, when the firm first confirmed a fake SSO page had captured an employee's credentials.
What actually happened inside ReliaQuest?
The employee typed their login details into a fraudulent single sign-on page. A single sign-on, or SSO, page is one master login that opens many internal systems, making it a valuable target. The credentials worked. ShinyHunters got in, but what they reached was a stripped-down view of one portal: read-only access, nothing sensitive within reach. Every attempt to open other applications or move sideways through the network was stopped.
The security principle behind this is called zero trust: getting past the front door does not automatically open every other door inside. The criminals had a key. It opened almost nothing.
ShinyHunters has a track record of low-impact break-ins paired with loud public boasting, borrowed from an earlier group called Lapsus$, which made headlines around 2022 by grabbing screenshots inside company portals and declaring victory. This looks like the same playbook.
ReliaQuest published a detailed postmortem, which is worth reading on its own terms. The firm admits phishing works and says it expects employees to occasionally fall for attacks. What it built were the controls that limited the damage once that happened. A breach headline and an actual breach can be very different things.
Did AI-written malware cause any of this?
No. Separately, Palo Alto Networks' research division Unit 42 published findings this week on 405 malware samples written with help from AI tools.
| Finding | Figure |
|---|---|
| Total AI-linked malware samples analysed | 405 |
| Samples seen on real, protected devices | 12 |
| Samples that appeared only in test environments | 97% |
| Real-world samples blocked by existing tools | 12 of 12 |
Every sample that reached a real device was caught by security software already in place. Unit 42 noted that most AI-written code looked like research experiments rather than finished weapons. Our own analysis on 26 August reached the same conclusion: AI is lowering the barrier to writing malicious code, but defences at mature organisations are still catching it. That could change as models improve. For now the threat is smaller than the headlines suggest.
Should ordinary people worry?
If you use a service protected by ReliaQuest, there is no indication customer data was reached. The criminals got a narrow, read-only look at one internal tool and were then locked out.
The broader lesson applies everywhere. Receive an unexpected call or message asking you to log in urgently? Stop. Contact the company or your IT team directly using a number you already trust. Criminals rely on the few seconds of panic before you think it through.
First reported by Dark Reading, this incident is a useful reminder to read breach disclosures before forming an opinion about them. Context is the whole story here.
