The Health Information Sharing and Analysis Center (ISAC) recently warned that ShinyHunters is using voice-phishing attacks to target the healthcare sector. “The hackers used medical-themed impersonation domains to trick healthcare employees into exposing their credentials.” More than a dozen organizations have been hit by these social-engineering attacks.

Health ISAC recommends:

• Employee Training and Awareness: Implement targeted security awareness training that educates staff on modern social engineering tactics, such as aggressive vishing calls and voicemail lures, ensuring they understand how to identify look-alike domains and safely verify internal IT communications.
• Enforce Device-Context Verification: Restrict SaaS applications, internal portals, and APIs to corporate-managed devices verified via client certificates, EDR health checks, or MDM profiles. Identity verification alone is insufficient without a defense-in-depth architecture.
• Transition to Phishing-Resistant MFA: Prefer FIDO2/WebAuthn security keys or passkeys for all admins and high-risk groups, and disable or tightly restrict SMS/voice MFA and weak fallback methods.
• Harden Helpdesk & MFA Reset Workflows: Require strict identity verification for MFA resets and ensure employees are trained that IT will “not reset MFA on inbound calls”.
• Monitor Lookalike Infrastructure: Track lookalike domain registrations, newly observed domains (NODs), and branded subdomains targeting corporate single sign-on services.
• Session Management: Set session timeouts that effectively support user workflows while ensuring security, restrict IdP visibility for non-compliance.

ShinyHunters continues to be a dangerous threat, and it is escalating its efforts in the healthcare sector, while simultaneously boldly attacking the FBI. Implementing the recommendations above should be a priority as it continues to ramp up its attack vectors.