Microsoft warns of sophisticated phishing campaign heavily targeting health care organizations

Microsoft Threat Intelligence is warning of a large scale, multistage phishing campaign that disproportionately targeted the health care sector, sending “code of conduct” themed emails to lure users into credential theft and token compromise. According to Microsoft, health care was the most targeted industry in the campaign, which reached more than 35,000 users across over 13,000 organizations, primarily in the U.S. The attack leveraged adversary in the middle techniques to intercept authentication tokens in real time, enabling attackers to bypass multifactor authentication and gain direct account access.  

“Phishing attacks are the most frequent and most effective methods of attacking the health care sector,” said Scott Gee, AHA deputy national director for cybersecurity and risk. “Training and vigilance are the keys to preventing these attacks. That training should also emphasize the ‘why.’ It’s not just about loss of protected health information, but the potential for shutting down critical systems and impacting patient care and safety.” 

Microsoft said the campaign underscores the sector’s continued attractiveness to cybercriminals due to sensitive patient data and operational pressures, and it urged hospitals and health systems to strengthen phishing resistant MFA, email security controls and workforce awareness to reduce risk.  

For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org or John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.