Attackers use home internet proxies to make stolen logins look local

A login from the right city is no guarantee the right person is behind it. Attackers are routing malicious sign-ins through home internet connections near their victims, according to threat research from security company ReliaQuest.

In a report dated 28 October 2026, the company describes social-engineering attacks that combine stolen identities with residential proxies. These services route traffic through real household internet connections, letting attackers choose an apparent location close to the legitimate user.

The aim is straightforward: make an intruder look local. ReliaQuest says the technique can help authentication attempts and device registrations avoid geographic-anomaly alerts, including “impossible travel” checks designed to catch logins from distant locations within implausibly short periods.

Unlike commercial VPNs or hosting services, residential connections can also lack the infrastructure reputation signals defenders use to spot suspicious traffic. That leaves security teams with a sign-in that looks geographically ordinary but is anything but.

The findings come from ReliaQuest’s own threat research, not independent validation. The company says the report concerns third-party incidents and the broader threat landscape, rather than its own environment.

According to ReliaQuest, this attack pattern requires neither malware nor a software exploit. A phone number, convincing pretext, impersonation domain and residential proxy can be enough to obtain a valid identity. Attackers can then use built-in software-as-a-service APIs to discover and retrieve data.

The company says it identified and blocked more than 350 related impersonation domains from March 2026 onwards. Monthly totals climbed from five in March to almost 100 during the first three weeks of October, with more than 50 blocked in one seven-day stretch in mid-October.

Many domains used passkey, single sign-on, Okta or enrolment themes and were put to use within hours of registration. ReliaQuest suggests automated templating or generative AI could explain the pace and consistency, but explicitly says that possibility is unconfirmed.

Once access was established, the window for intervention could be tight. ReliaQuest reports suspected data exfiltration starting about six minutes after initial access in one incident and about 15 minutes after access in another.

There is a logging trap, too. The company says Microsoft Graph and other cloud APIs can retrieve content through operations recorded as file access rather than conventional downloads. It observed files appearing on data-leak sites even where available telemetry showed access events without corresponding download events.

ReliaQuest’s advice is to stop treating familiar geography as proof of legitimacy. It recommends phishing-resistant multi-factor authentication, managed-device requirements for sensitive cloud applications and Conditional Access controls that block untrusted devices. Unusual, large-scale file access deserves scrutiny even when no download alert fires.