Health-ISAC Warns ShinyHunters Is Walking Through Hospital Logins

Health-ISAC warned on September 3, 2026 that ShinyHunters is hitting health groups with vishing, look-alike logins, and MFA bypass. The alert, filed August 28 as 24113aee, says the crew has already succeeded in recent cases by taking single sign-on sessions and moving into Microsoft 365, SharePoint, and Salesforce.

The notice is the second public Health-ISAC warning on this crew in six weeks. The first, on July 24, already mapped the path. The September note says the phone calls are still getting through, now on personal mobiles and on newly registered .claim and.claims domains.

Health-ISAC Puts the Phone Call on the Record

In its urgent threat alert on vishing campaigns, Health-ISAC said it had spent the prior two weeks warning several health organizations after watching persistent, tightly aimed voice phishing. Callers and voicemails reach staff on personal phones. Mass mail also arrives from throwaway accounts. The login pages mimic the company. The most identifiable tell, the alert said, is a domain stood up as company-claims.com or company.claims.

For ShinyHunters, the SSO platform is the control plane. Once an identity is compromised, the actors rapidly pivot from the central identity provider (IdP) dashboard into connected SaaS platforms (such as Microsoft 365, SharePoint, and Salesforce) to exfiltrate sensitive data and internal communications.

Health-ISAC, Urgent Threat Alert, September 3, 2026

Health-ISAC posted the same warning from its own account the day it published the note.

The ShinyHunters cybercrime gang poses a clear and present danger to the global health sector, representing an immediate threat through persistent, highly targeted voice phishing(vishing) campaigns that aim to trick enterprise personnel into exposing credentials on malicious,… pic.twitter.com/LJyLlCWuDT

— Health-ISAC (@HealthISAC) September 3, 2026

The group’s own words are blunt about what this is not. Recent campaigns, it said, show ShinyHunters behaving less like a traditional ransomware crew and more like an identity and SaaS-access extortion shop. There is no encryptor on a clinical workstation in this model. There is a live web session, stolen from a person who thought IT was on the line.

WHAT WE KNOW

• The path: Vishing and look-alike SSO pages lead to credential theft, MFA bypass, and a pivot from the identity dashboard into connected cloud apps.
• The lure: Newly registered domains prefix the target company name, with Health-ISAC calling out.claim and.claims unless those names are the org’s own kit.
• The session: Reverse-proxy kits replay the password to the real login while the caller asks for a one-time code or a push approval.
• The earlier memo: A July 24 Health-ISAC advisory already described the same chain through Microsoft Entra, Okta, or Google SSO.

WHAT IS UNCONFIRMED

• Leak-site counts: ShinyHunters often posts huge record totals after a theft; Health-ISAC treats the tradecraft as the lesson even when a claim has not been checked.
• Named health victims: Public chatter has tied the pattern to several health and medtech firms; the two ISAC notes do not publish a victim list.
• How many calls landed: Health-ISAC says several organizations were warned and that some recent cases succeeded, without a tally of compromised accounts.

That gap is why the September alert reads as a second knock, not a first discovery. The method was already on paper in July. The new detail is that the same crew is still getting live MFA tokens from health workers who pick up the phone.

The Playbook Already Hit Snowflake and Salesforce

ShinyHunters did not invent a health-only tool for this run. Google Threat Intelligence Group, in a June 4, 2025 note on voice phishing to data extortion, tracked a cluster it calls UNC6040 that impersonates IT support, tricks staff into approving a connected app (often a modified Salesforce Data Loader), and pulls CRM data for later pressure. In every case GTIG observed, the break was a person being talked through a step, not a hole in Salesforce itself.

GTIG tracks later shakedown activity as UNC6240. Those follow-up calls and mails, sometimes months after the theft, demand bitcoin within 72 hours and consistently claim the ShinyHunters name. On August 5, 2025, Google said one of its own corporate Salesforce instances had been hit by similar UNC6040 activity, with contact data for small and medium businesses taken in a short window before access was cut. An FBI FLASH dated September 12, 2025 (FLASH-20250912-001) said UNC6040 had been using vishing against Salesforce accounts since October 2024, and that some victims later got extortion mail under the ShinyHunters brand.

THE PATH INTO HEALTH SSO

1. October 2024: FBI says UNC6040 begins vishing its way into Salesforce accounts, including by posing as IT on connectivity tickets.
2. June 4, 2025: GTIG publishes the UNC6040 vishing-to-Data-Loader method and the later UNC6240 extortion cluster that uses the ShinyHunters name.
3. August 5, 2025: Google confirms a corporate Salesforce instance used for small-business contacts was accessed in the same activity.
4. September 12, 2025: FBI releases FLASH-20250912-001 on UNC6040 and a separate Salesforce token campaign tracked as UNC6395.
5. July 24, 2026: Health-ISAC tells the health sector the same identity-to-SaaS chain is succeeding against Entra, Okta, and Google SSO.
6. August 22, 2026: A Health-ISAC TLP WHITE note describes a ShinyHunters-linked vishing run against ReliaQuest using a look-alike SSO page.
7. August 28, 2026: Health-ISAC files alert 24113aee at 3:37 p.m. EDT; it publishes the urgent version on September 3.

Microsoft Threat Intelligence, on July 13, 2026, said it had seen overlapping tradecraft commonly tied to ShinyHunters, including vishing and OAuth abuse against SaaS apps, with trusted app relationships doing the work that a malware drop used to do. The health-sector alerts sit on that same line. The clinical network can be segmented and backed up and still lose the contents of SharePoint and Salesforce once SSO is the door.

Why Help Desks Still Open the Door

Health-ISAC says the opening work is research. Callers study named employees and the desks they will pretend to be, often IT help desks or legal operations. They spoof known company numbers so the first ring feels internal. Staff are wired to help those functions. Follow-up voicemails pile on if the first call does not land.

The July advisory put the help desk at the center of the chain: a voice call leads to a password reset, an MFA reset, or a new device enrollment, and that becomes an Entra, Okta, or Google SSO takeover. The practical rule it wanted was a “no same-call” reset. The agent on an inbound line cannot finish a reset in that conversation. A ticket and a verified callback to a number already on file have to sit in between, with extra checks for executives, admins, finance, and security.

A Health-ISAC TLP WHITE note posted August 24 with the American Hospital Association walks through one such run. On August 22, 2026, actors linked to ShinyHunters hit ReliaQuest vishing and lookalike SSO with a typosquat domain behind a content network, posing as a named internal security staff member. One employee typed corporate credentials into the fake portal and then approved an MFA push. The harvested password and the approved token gave the caller an active session on the identity dashboard, which is exactly the control plane the September alert describes.

The same method is now on tape outside health. On September 7, 2026, Dutch police released audio of a man who called Odido customer service posing as IT; police said the recording is not AI, and that the call is how ShinyHunters ended up with data on more than 6 million customers. Replies to that release keep returning to a simple sequence: no malware, no zero-day, a help desk that tried to be useful. Awareness slides do not stop a spoofed internal number if the reset still happens on the inbound line.

Personal Phones and the.Claims Lure

The September alert adds a bypass that network filters on a managed laptop cannot see. Callers tell staff to open the link on a personal device, away from corporate browser controls, EDR, and the company VPN. Once the password is typed, reverse-proxy kits submit it to the real login in real time. The person on the phone is then asked for the MFA code or told to accept a push, which hands the attacker a live web session.

Health-ISAC also flagged medical-themed domains aimed at health operations and specialized business units, not only a generic IT lure. The registration pattern is a company name up front and a lure ending behind it. Blocking .claim and.claims at the edge, unless those names are legitimate infrastructure, is the first concrete step in the September note.

HOW THE CALL IS BUILT

• Recon: Named staff and the desks being spoofed, including IT and legal, are researched before the ring.
• Spoofed caller ID: A number that looks internal does the trust work that a cold email cannot.
• Personal-device instruction: The lure is opened off the managed fleet, where look-alike pages are harder to catch.
• Reverse proxy: The typed password is replayed to the real portal while the victim is still on the line.
• MFA on the call: A code is read out, or a push is accepted, and the attacker keeps the session.

Look-alike infrastructure has to be watched as a live feed, not a quarterly review. Health-ISAC wants newly registered domains, newly observed domains, and branded subdomains that target corporate SSO tracked as they appear. Session rules should time out in a way staff can still work, hide the identity dashboard from endpoints that fail device checks, and alert on simultaneous logins from odd places or addresses.

What FIDO2 Changes for a Vishing Call

Push MFA is doing what it was built to do in these incidents. The user is on a call that sounds like IT, sees a prompt, and approves it. The second factor is satisfied. The session is real. Health-ISAC’s fix is to move admins and other high-risk groups onto FIDO2 and WebAuthn security keys or passkeys, and to shut down or tightly limit SMS, voice, and other weak fallbacks.

CISA’s public MFA guidance makes the same cut. The agency says phishing-resistant MFA is the standard to aim for, and that the implementing phishing-resistant MFA path runs through FIDO and WebAuthn, because a fake site cannot complete that ceremony. Number matching on push apps is an interim step if a full move is delayed, not a substitute.

MFA UNDER THIS CALL

Keys do not close the help-desk hole by themselves. If a reset desk can enroll a new authenticator for someone who only sounds right on an inbound call, the attacker gets a fresh factor. Health-ISAC wants MFA reset workflows to require strict identity checks, and it wants staff told, in those words, that IT will not reset MFA on inbound calls. Device context has to sit beside identity: SaaS apps, internal portals, and APIs limited to corporate-managed devices checked by client certificates, EDR health, or MDM profiles.

The 60-Day List Hospitals Already Had

The September alert’s to-do list is shorter than July’s and aimed at the new lures: block.claim and.claims, train on aggressive vishing and voicemail, force managed devices, move high-risk users to FIDO2, harden MFA resets, watch look-alike domains, and tighten sessions. The fuller control set was already in the July 24 note, which treated Entra, Okta, and Google SSO as Tier 0, the way a domain controller is treated, because that is how this crew uses them.

That July 30 to 60 day shortlist is still the working order for a health system that has not closed the path.

JULY SHORTLIST STILL IN FORCE

• Phishing-resistant MFA: Keys or passkeys for admins, help-desk staff, and executives, with weak fallbacks shut down.
• Help-desk resets: Verified callback, no same-call resets, and ticketing so an inbound voice cannot finish the change.
• Conditional access: Block legacy auth and require a compliant device for admin work and data-rich apps.
• SaaS theft alerts: Watch bulk downloads, odd API calls, new OAuth consents, and MFA reset events.
• Revocation drills: Practice killing sessions and refresh tokens, then re-enrolling MFA on a trusted path.

July also wanted SaaS and identity logs treated like endpoint telemetry: Entra sign-in and audit logs plus M365, SharePoint, OneDrive, and ServiceNow audit trails in the SIEM, with alerts on new MFA factors, new devices, new OAuth apps, mass file access, and new mailbox forwarding. Least privilege inside SharePoint and Teams cuts what one stolen session can carry. A containment playbook that already knows how to revoke tokens is faster than an incident team discovering the identity dashboard after the data has left.

Extortion That Skips the Ransomware Note

Health-ISAC’s July line is the one that should sit on a CISO desk next to the backup metrics. SSO is the control plane, and the leverage is data theft at cloud scale. Even when a victim statement talks about limited operational impact, the stolen mail, SharePoint sites, and Salesforce objects are the payload. The shakedown can wait weeks or months, which is how UNC6240 worked after UNC6040 thefts in 2025.

That is a different failure than a locked electronic health record. Restoring from backup does not retract a copy of patient files, contracts, or staff mail that already left through a connected app. Legal, communications, and regulator clocks start on the theft, not on an encryptor. Health-ISAC told members to pre-stage SaaS containment, watch leak sites, and have a stance ready for extortion, including whether and how to talk to law enforcement.

The September alert’s last practical orders are small on purpose. Block.claim and.claims unless they are yours. Stop MFA resets on inbound calls. Put FIDO2 on the people who can open the identity dashboard. Dutch police, on September 7, 2026, played a call they say is not synthetic: a man posing as IT, a desk that helped, and more than 6 million customer records gone. Health groups are being asked to pick up the same kind of line.