Health-ISAC has issued a threat bulletin warning that the ShinyHunters cybercrime group is running targeted voice phishing (aka vishing) campaigns and registering medical-themed impersonation domains to breach health sector organizations.
The nonprofit cybersecurity information-sharing group said Sept. 3 it has sent targeted alerts to multiple health sector organizations over the past two weeks after observing ShinyHunters bypass multifactor authentication to pivot from single sign-on platforms into connected SaaS applications, including Microsoft 365, SharePoint and Salesforce, for large-scale data exfiltration and extortion.
The attackers register lookalike domains using a target company’s name paired with “-claims[.]com” or similar endings, then call and leave voicemails for employees on personal mobile devices while impersonating internal departments such IT help desks, according to Health-ISAC. Victims who enter credentials on the spoofed pages have that information relayed in real time to the legitimate login portal through reverse-proxy phishing kits, and are then pressured by phone to approve an MFA prompt.
Health-ISAC recommended organizations block the .claim and .claims top-level domains, move to phishing-resistant MFA such as FIDO2 or passkeys, require strict verification for helpdesk MFA resets, and restrict SaaS access to corporate-managed devices.
The bulletin follows Health-ISAC’s earlier warning tying ShinyHunters to a data-theft campaign that included the alleged breach of Baxter International, underscoring the group’s shift toward identity- and SaaS-access extortion across the health sector.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
