ShinyHunters Vishing Campaign Targets Healthcare SSO Accounts — Health-ISAC Issues Active-Threat Alert as Group Escalates Microsoft Entra and Okta Takeovers

Health-ISAC issued a July 24 advisory warning of a measurable increase in successful ShinyHunters intrusions against healthcare and medtech organizations, driven by a repeatable chain of voice phishing (vishing) against helpdesk staff to force MFA resets, followed by Microsoft Entra/Okta/Google SSO account takeover and rapid mass-exfiltration from Salesforce, Microsoft 365, SharePoint, and Snowflake. In confirmed incident reporting, ShinyHunters vished multiple employees at a healthcare target to compromise a Microsoft Entra SSO account and stole data from M365 and SharePoint before detection; the group previously used the same playbook against Abbott Laboratories' Cancer Diagnostics business in mid-July. The group prioritizes data theft and extortion leverage over ransomware deployment, making traditional endpoint-centric defenses insufficient — defenders should enforce phishing-resistant MFA, restrict helpdesk self-service enrollment, and monitor OAuth token issuance from SSO platforms.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.