ReliaQuest warns of proxy-backed cyber attacks on logins

ReliaQuest has reported a rise in cyber attacks that use residential proxies to mask social-engineering attempts. The tactic helps attackers make fraudulent logins appear local to victims.

The method routes internet traffic through real home broadband connections chosen to match a target's city or region. That can weaken location-based security checks, including alerts for logins from unusual geographies or so-called impossible travel, where the same account appears to sign in from distant countries within a short period.

ReliaQuest said it had identified and blocked more than 350 impersonation domains linked to the activity since March 2026. Monthly volumes rose from five in March to almost 100 in the first three weeks of October. In one seven-day period in mid-October, it blocked more than 50 domains.

Many of those domains used passkey, single sign-on, Okta or enrolment themes, according to the report. They were often turned into active lures within hours of registration. The speed and consistency of creation suggested automated templating or possible use of generative AI, although that was not confirmed.

Attack pattern

The report describes an attack chain that begins with phone calls, text messages or external collaboration requests rather than email. Attackers pose as IT help desk staff, HR or legal personnel and direct employees to fake identity, passkey or enrolment pages to capture credentials or session tokens.

Once an identity is compromised, the attacker can authenticate through a residential proxy near the victim's expected location. That may make the sign-in and any device registration look routine, reducing the value of long-used indicators such as IP reputation and geographic anomalies.

Earlier campaigns relied more heavily on commercial VPNs and hosting infrastructure that defenders could identify through known abuse patterns or autonomous system number reputation, ReliaQuest said. Residential proxies, by contrast, use IP addresses with no established malicious history and locations that can resemble normal user behaviour.

The attacks require no malware, software exploit or advanced custom tooling, according to ReliaQuest. A phone number, a plausible pretext, an impersonation domain and access to a residential proxy service can be enough to obtain a valid identity and begin moving through connected cloud applications.

Rapid exfiltration

ReliaQuest said clean-looking authentication is often only the first step. In one incident, suspected exfiltration activity began about six minutes after initial access. In another, it began about 15 minutes after access was established.

Attackers used built-in software-as-a-service APIs, including Microsoft Graph, to enumerate repositories, open or preview files, synchronise content and retrieve data, the report said. As a result, a breach may not always generate a conventional file-download event even when large amounts of information are being taken.

In one SharePoint case, Microsoft Graph API clients generated tens of thousands of file-access events across hundreds of sites. In another incident, an attacker scanned more than 23 billion database rows and extracted about 136GB during a 14-hour automated query session.

Those patterns show defenders may need to treat high-volume file access, unusual access sequences and automated API behaviour as signs of possible exfiltration, even when audit logs do not explicitly classify the activity as a download, the company said. In several incidents, files later appeared on leak sites despite telemetry showing access events but no matching file-download records.

Extortion risk

The report also warned that one stolen identity can open paths into several cloud environments through single sign-on. A single account may provide access to email, SharePoint, Salesforce, analytics platforms and sandbox environments, while disabling the user in one application may not automatically cut access in connected systems.

ReliaQuest said attackers have claimed possession of hundreds of thousands of files, tens of thousands of email items and millions of database records. Observed data included customer engagement records, financial information, employee credentials and other internal documents across multiple subsidiaries.

That access can support extortion demands that cite internal files, customer relationships and commercially sensitive information. Organisations may face containment and notification decisions without a definitive event showing exactly what data left the environment, the company warned.

Defensive measures

ReliaQuest said organisations should no longer treat familiar geography as proof that a sign-in is legitimate. It recommended phishing-resistant multi-factor authentication, managed-device requirements for sensitive software-as-a-service applications, and conditional access policies that block untrusted devices before attackers can use a stolen identity.

The report also called for stronger help desk and account-recovery workflows, including out-of-band identity verification for password resets, MFA enrolment and account unlocks. It advised companies to link identity changes such as password resets, authentication-method updates and device registration to rapid follow-on data access to spot intrusions earlier.

"Defenders should no longer treat familiar geography as evidence that a sign-in is legitimate," ReliaQuest said.