ReliaQuest's Threat Research team describes attackers who combine social engineering with residential proxies. The proxies exit near the victim's expected city or region, so malicious sign-ins and device registrations look routine and evade "impossible travel" and geographic-anomaly alerts.
According to the report, the campaign relies on cheap, repeatable steps: a phone call or lookalike domain, a stolen identity, and built-in SaaS APIs for data theft. No malware is needed. ReliaQuest counts more than 350 impersonation domains blocked since March 2026, with monthly totals rising from 5 in March to almost 100 during the first three weeks of October. In some intrusions, actions on objectives began within six minutes of initial access.
The report names no proxy provider. Its recommendations are phishing-resistant MFA (FIDO2 keys or passkeys), access to sensitive SaaS apps only from managed devices, and out-of-band verification before password resets or MFA enrolment. For proxy customers, the report is a reminder that residential IPs are used by attackers too, and that location and IP reputation alone are no longer a reliable signal.
Source: ReliaQuest, "Threat Spotlight: Residential Proxies Mask Social-Engineering Attacks". The report is undated on the page; the date given here is the date of the search index entry.