Health-ISAC has warned healthcare and medical technology organizations that the ShinyHunters group is breaking into hospital networks by calling helpdesks, tricking staff into resetting passwords or MFA, then hijacking the single sign on account behind Microsoft Entra ID, Okta, or Google Workspace. From there they move into Microsoft 365, SharePoint, and Salesforce to steal data for extortion. The fix is not a new tool, it is closing the verification gap at the helpdesk and switching to phishing resistant MFA.
I have read a lot of security advisories over the years, and most of them make me shrug. This one did not. Health-ISAC just told hospitals, clinics, and medical device makers across the country that ShinyHunters is getting into their networks through a phone call. Not malware. Not a leaked exploit. A phone call.
Someone rings the helpdesk, sounds convincing enough, and walks away with a password reset that should never have happened. From there it is game over, because that one login opens the door to everything else the hospital plugged into it. Medtronic already learned this the hard way. So did DentaQuest and iRhythm. If you run IT or security for a healthcare organization, this is not background noise. This is the thing that will land on your desk next.
Key Facts at a Glance
- Issuer: Health-ISAC, warning healthcare and medical technology organizations
- Attacker: ShinyHunters, also tracked as UNC6040 and UNC6395
- Entry point: voice phishing (vishing) calls targeting helpdesk staff
- Primary target: Microsoft Entra ID, Okta, and Google Workspace single sign on accounts
- Downstream impact: Microsoft 365, SharePoint, Salesforce, Slack, DocuSign, and other connected SaaS apps
- Named organizations affected in public reporting: Medtronic, DentaQuest, iRhythm, OneMedical
- Core fix: out of band callback verification, phishing resistant MFA, Tier 0 treatment of identity systems
Who Are ShinyHunters?
ShinyHunters used to be a fairly boring name in the breach world, at least by cybercrime standards. Steal a database, dump it on a forum, sell access to whoever pays first. That still happens. But somewhere along the way someone in that group had a better idea. Why steal one database when you can steal the one login that controls a dozen platforms at once?
That is the whole point of single sign on, and it is exactly what makes it so dangerous once it falls into the wrong hands. Researchers tracking this crew under labels like UNC6040 and UNC6395 have watched them shift from smash and grab data theft into something closer to a coordinated extortion business, one where the identity system itself is the target, not any single app sitting behind it.
How Does the ShinyHunters Vishing Attack Actually Work?
Try to picture it. A helpdesk agent at a regional hospital network is having a normal shift. The phone rings. Someone on the other end sounds rushed, a little annoyed even, claims to be a physician who got locked out right before rounds. Name checks out. Department checks out. This is not some copy paste phishing template.
ShinyHunters builds custom vishing kits, basically a live dashboard that lets the caller change what the victim sees on a fake login page while the conversation is still happening. Ask a verification question, and the page updates in real time to match. It genuinely feels less like phishing and more like a live performance built for one audience member.
Once that agent resets the password, or worse, approves a brand new MFA device, the account belongs to the attacker. And if that account has any real reach into Entra ID, Okta, or Google Workspace, they are not inside one app anymore. They are inside the control plane for everything. No further hacking required at that point.
They just log in, using valid credentials, to Salesforce, SharePoint, Slack, DocuSign, whatever the hospital happened to connect. Some of these incidents show attackers riding along on OAuth connections that already existed between two platforms, say Salesforce talking to Snowflake, pulling data through an API path nobody was really watching because nobody thought of it as a security boundary in the first place.
Why is Healthcare the Target Right Now?
I do not think hospitals are technically weaker than a bank or a retail chain. What makes them a target is leverage, plain and simple. You cannot cancel and reissue a patient's medical history the way you cancel a stolen card number.
A hospital staring down the threat of leaked treatment records, or billing details tied to real patients mid care, feels enormous pressure to pay fast rather than fight it out in public. Health-ISAC did not name every affected organization in its advisory, but public reporting already ties recent ShinyHunters activity to Medtronic, DentaQuest, iRhythm, and OneMedical, and that alone tells you how far this has already spread across device makers, insurers, and providers.
What Actually Stops This
Every fix below exists for one reason only, to make the phone call worthless to the attacker even if the person on the other end believed every word of it.
| Weak Point | What Gets Exploited | The Fix |
|---|---|---|
| Helpdesk resets | Same call reset, no verification loop | No same call reset rule, mandatory callback to a number already on file |
| Privileged accounts | Execs, IT admins, finance staff get the same treatment as everyone else | Second approver required before touching a high risk account |
| MFA method | SMS and voice codes captured live mid call | FIDO2 or WebAuthn hardware keys, SMS and voice OTP turned off completely |
| New device enrollment | Attacker enrolls their own device as a trusted factor | New MFA enrollment allowed only from a device that is already managed |
| The identity platform itself | Treated like just another app instead of the crown jewel | Classified as Tier 0, zero trust rules, legacy protocols blocked outright |
| Connected SaaS apps | Old OAuth grants nobody has looked at in a year | Regular audits, revoke anything unused or over permissioned |
What is the 60 Day Response Plan for a Health System?
Reading an advisory and doing something about it are two very different activities. Here is roughly how a mid sized health system could realistically move through the next sixty days.
Weeks one and two are about stopping the bleeding, nothing fancy. Put the no same call reset rule in writing and train the helpdesk on it right away. Turn off SMS and voice based MFA wherever it still lingers. Pull a full list of OAuth apps with access into core systems, because most teams have no idea what is actually connected until they look.
Weeks three and four are where the real guardrails go up. FIDO2 hardware keys start going out, executives and IT and finance first since they carry the most risk. Conditional access policies start requiring a managed device before anyone can touch the identity platform. And logs from the SSO provider, Microsoft 365, and whatever SaaS tools are connected finally land in one place, so an analyst is not bouncing between five different dashboards trying to piece a story together.
The last month is the one most organizations quietly skip, and it happens to be the part that matters most. Run an actual simulated vishing call against your own helpdesk. See if the new rules hold up when a convincing voice is pushing back on the other end of the line. Then test the response playbook for real, revoking sessions, killing rogue OAuth grants, freezing an account, with a stopwatch running instead of just assuming it will work when it counts.
What Does Good Detection Look Like?
None of the useful signals here are exotic or require some fancy AI tool. A brand new MFA device registered from an unfamiliar location, followed minutes later by a login from that same device, is a loud red flag. So is a sudden spike in downloads from SharePoint or Salesforce that does not match how that person normally works.
So is a fresh OAuth application asking for sweeping permissions like reading every mailbox in the tenant. Catching this stuff just takes someone actually watching the identity logs with rules built for this exact pattern, instead of generic antivirus style alerts left over from a completely different era of threats.
Frequently Asked Questions
Why does ShinyHunters go after the login system instead of hacking the patient records database directly?
Because one compromised identity can unlock a dozen connected systems at once, while breaking into a single database only ever gets you that one database. It is simply a better return for the effort.
Does strong MFA alone stop this?
Only if it is phishing resistant. Push notifications and text codes can be captured live during a vishing call, because a human is talked into approving them in real time. Hardware based FIDO2 keys cannot be phished this way, there is no code for a person to hand over in the first place.
Is this only a big hospital network problem?
No. Any organization running cloud identity platforms like Entra ID, Okta, or Google Workspace connected to business apps is a potential target, size does not really matter here. Small clinics and device vendors are just as exposed, often more so, since they usually run with fewer dedicated security staff.
What should a helpdesk agent do when a caller pushes back on verification?
End the call. Call the number already on file for that employee. A legitimate employee is never going to be upset about a callback that protects their own account, only an attacker will be.
What is the Health-ISAC ShinyHunters advisory about, in one sentence?
It is a warning that ShinyHunters is using phone based social engineering against healthcare helpdesks to hijack single sign on accounts and steal data from the SaaS platforms connected to them.
None of this is a new idea, attackers have always hunted for the weakest human link sitting behind otherwise solid defenses. What changed is how quickly one successful phone call can now turn into access across an entire hospital's digital footprint. Fixing it does not require reinventing security from scratch. It just requires treating the identity platform with the same weight as the server room it effectively replaced, because right now, for a lot of organizations, it is not being treated that way at all.
Related Reading From Hoplon Infosec
- How hackers exploit ADFS to bypass MFA and breach systems, a close look at how attackers target single sign on infrastructure directly, the same weak point ShinyHunters is going after
- The Klue Salesforce breach and its OAuth token attack, showing how a stolen OAuth token can bypass MFA entirely once an attacker is past the login screen
- Why voice cloning and deepfake vishing are becoming mainstream threats, useful context on how convincing these live phone based attacks have gotten
- Why zero trust security is no longer optional, the broader framework behind treating identity systems as Tier 0
- A rundown of the biggest healthcare data breaches of 2025 and 2026, for anyone who wants the wider pattern of what happens when credentials and MFA gaps go unaddressed
Threat details may change as new information emerges, verify the latest guidance directly through Health-ISAC before acting.
-20260729102805.webp&w=3840&q=75)
