Threat intelligence analysts have uncovered a sophisticated new methodology that merges social engineering with residential proxy networks—routing malicious traffic through legitimate home internet connections. This strategy enables attackers to execute passkey-themed breaches capable of extracting sensitive data in as little as six minutes from the moment of initial access. Notably, unlike recent headlines surrounding vulnerabilities in PHP or Google’s Brotli compression algorithm, this emerging assault vector achieves its objectives without exploiting underlying software flaws or deploying traditional malware.

The Mechanics of Residential Proxy Exploitation

Published findings from the ReliaQuest Threat Research team on October 28 reveal that threat actors are leveraging residential IPs to masquerade as the targeted user's genuine geographic location. By blending social engineering with these localized proxies, perpetrators successfully bypass security controls designed to flag anomalous behavior, such as logins originating from unexpected regions or impossible travel scenarios where credentials are utilized across disparate countries within minutes.

Routing authentication and device registration through home networks closely tied to the victim neutralizes conventional defense mechanisms. Past campaigns relied heavily on commercial VPNs or hosting infrastructure that easily triggered reputational abuse-pattern filters. However, researchers noted that when a source IP lacks a malicious footprint and matches expected locality metrics, distinguishing fraudulent access from legitimate user activity becomes exceptionally difficult.

From Initial Call to Full Data Exfiltration in Six Minutes

Echoing classic social engineering playbooks, these operations frequently commence via phone calls, text messages, or external collaboration requests targeting corporate employees while impersonating IT support or internal departments. Once credential harvesting or session token theft succeeds, the adversary channels subsequent device registration and authentication through a residential proxy situated near the compromised employee's location.

This tactical maneuver secures persistent access channels that survive standard password resets, permitting unrestricted navigation of cloud-connected applications and repositories. Investigators confirmed that targeted environments include Microsoft 365 mailboxes, SharePoint, Salesforce, and enterprise analytics dashboards. Alarmingly, the ReliaQuest report highlighted instances where data exfiltration began roughly six minutes after initial entry, outstripping the time required for authentication logs to clear SIEM detection logic and alert security analysts.

To mitigate these advanced threats, security experts strongly recommend deploying phishing-resistant multi-factor authentication, such as FIDO2 security hardware or platform-bound passkeys, across all administrative and workforce accounts while systematically phasing out vulnerable SMS and push-notification approval models.