Urgent Threat Alert: ShinyHunters Vishing Campaigns and Domain Impersonation

September 3, 2026

ShinyHunters Vishing Campaigns and Domain Impersonation Actively Targeting the Global Health Sector

Threat Bulletins | TLP:WHITE | ALert ID : 24113aee | August 28, 2026 | 03:37 PM EDT

The ShinyHunters cybercrime gang poses a clear and present danger to the global health sector, representing an immediate threat through persistent, highly targeted voice phishing(vishing) campaigns that aim to trick enterprise personnel into exposing credentials on malicious, medical-themed impersonation domains.

This group is actively targeting the health sector and has been successful in several recent cases by bypassing multi-factor authentication (MFA) to rapidly pivot from single sign-on(SSO) platforms to connected SaaS applications for large-scale data exfiltration and extortion. Because these campaigns pose a severe risk of compromised credentials and unauthorized access to corporate infrastructure, we highly encourage all Health-ISAC members to immediately review and strictly follow the recommendations provided below.

Over the past two weeks, Health-ISAC has issued warnings to several health sector organizations after observing persistent, highly targeted vishing campaigns. These campaigns attempt to trick users into exposing their credentials on malicious sites that mimic legitimate login pages, thereby facilitating unauthorized initial access.

The most identifiable part of the operation is that domains are stood up with company-claims[.]com or company[.]claims impersonating the company in the domain.

Recent observations indicate that threat actors—specifically tied to the ShinyHunter sextortion group—are reaching employees directly on personal mobile devices via calls and voicemails, as well as emailing users en masse from multiple random accounts.

The recent registration of medical-themed domains indicates an expanding scope targeting health operations and specialized business units, underscoring the intent to establish persistent initial access across diverse enterprise sectors. [See graph in the PDF]

For ShinyHunters, the SSO platform is the control plane. Once an identity is compromised, the actors rapidly pivot from the central identity provider (IdP) dashboard into connected SaaS platforms (such as Microsoft 365, SharePoint, and Salesforce) to exfiltrate sensitive data and internal communications. This data theft at a cloud scale provides the necessary leverage for their subsequent extortion demands.

The primary operational pattern identified across these infrastructure registrations is the use of the newly registered domains prefixed with the target company’s name, followed by variable endings tailored to specific phishing lures.

These campaigns pose a severe risk of compromised credentials, multi-factor authentication (MFA) bypass, and subsequent unauthorized access to corporate infrastructure and cloud/SaaS platforms.

Health-ISAC delivered batches of Targeted Alerts to several organizations after intelligence partners shared insights that look-alike and impersonation domains were set up using infrastructure that impersonates the legitimate company. This had led to users having their credentials compromised on pages that resemble legitimate company login portals.

Analysis

The observed threat activity highlights a highly organized, adaptive threat actor executing broad social engineering campaigns to acquire valid corporate credentials and active MFA Tokens.

Recent campaigns have shown that ShinyHunters is behaving less like a traditional ransomware group and more like an identity- and SaaS-access extortion operation.

Pre-Operational Reconnaissance and Vishing

In the initial phases, the actors likely rely heavily on pre-operational reconnaissance, conducting extensive research on targeted employees and the specific internal departments (such as IT help desks or legal operations) they choose to impersonate.

By spoofing known organizational phone numbers, callers establish immediate trust and exploit staff’s natural inclination to assist internal support functions.

Furthermore, ShinyHunters actors have been observed acting aggressively, frequently utilizing follow-up voicemails to pressure targets into compliance and instructing users to bypass corporate security controls by navigating to malicious links on personal devices.

Once the user submits their credentials on the phishing site, the threat actor uses reverse-proxy phishing kits to submit them to the legitimate corporate login portal in real time. The victim is then prompted over the phone to provide their active MFA token or to accept a push notification, granting the attacker an active web session.

Recommendations

Health-ISAC provides this information to increase situational awareness and encourage organizations to prevent the successful exploitation and disruption of their security apparatus.

Block the .claim and .claims top-level domains within your organization unless they are legitimate infrastructure.

Employee Training and Awareness: Implement targeted security awareness training that educates staff on modern social engineering tactics, such as aggressive vishing calls and voicemail lures, ensuring they understand how to identify look-alike domains and safely verify internal IT communications.
Enforce Device-Context Verification: Restrict SaaS applications, internal portals, and APIs to corporate-managed devices verified via client certificates, EDR health checks, or MDM profiles. Identity verification alone is insufficient without a defense-in-depth architecture.
Transition to Phishing-Resistant MFA: Prefer FIDO2/WebAuthn security keys or passkeys for all admins and high-risk groups, and disable or tightly restrict SMS/voice MFA and weak fallback methods.
Harden Helpdesk & MFA Reset Workflows: Require strict identity verification for MFA resets and ensure employees are trained that IT will “not reset MFA on inbound calls”.
Monitor Lookalike Infrastructure: Track lookalike domain registrations, newly observed domains (NODs), and branded subdomains targeting corporate single sign-on services.
Session Management: Set session timeouts that effectively support user workflows while ensuring security, restrict IdP visibility for non-compliant

Health-ISAC provides this information to prevent the successful exploitation and disruption of your security apparatus. For more information, see Health Industry Cybersecurity Practices(HICP): Managing Threats and Protecting Patients.