What do health care organizations need to know about vishing?

Key takeaways

Health-ISAC and Mandiant both warn that groups like ShinyHunters are making voice phishing a go-to tactic in healthcare. The playbook is consistent: spoof an internal number, pressure an employee into a fake remote login page and harvest the MFA tokens and credentials needed to roam the network and extort the victim, with AI now compressing target research from hours to minutes and erasing language barriers. Errol Weiss and Trevor Horwitz point to the help desk as the control that matters most, with vishing simulations, tighter identity verification for MFA resets and phishing-resistant authentication as the fixes.

Central Ohio Primary Care Physicians was hit with a voice-based phishing (vishing) attack in August, an incident involving the protected health information (PHI) of 1.4 million patients, The HIPAA Journal reports. 

The attack is one of a growing number of vishing incidents hitting healthcare. Mandiant flagged the tactic’s rise among financially motivated groups in its M-Trends 2026 report, and Health-ISAC has warned specifically about ShinyHunters, which has run highly targeted vishing campaigns against the sector.

Errol Weiss, CSO at Health-ISAC, and Trevor Horwitz, founder and CISO of cybersecurity company TrustNet, spoke to DHI about this attack vector and what healthcare organizations can do to protect themselves. 

Threat group ShinyHunters has found a niche in healthcare

Weiss describes the ShinyHunters group as “sophisticated” and “relentless.” “They’ve found themselves a niche, and they’re good at it,” he told DHI.

The group uses vishing to impersonate internal teams. It spoofs phone numbers, making the incoming call look like it is coming from within the company.

“They will apply a lot of pressure to employees to ultimately get them to visit a fake website that looks a lot like the remote login site that they’re used to,” Weiss explained. “They will have a very convincing story.”

That convincing story may lead victims to give members of the threat group multifactor authentication (MFA) tokens and corporate credentials that allow them to bypass security controls and gain network access.

“Once they’re inside the network, they will roam around and figure out what they can steal, what they can grab data wise and use that to extort additional money from that victim,” Weiss added.

AI is going to make vishing campaigns even more convincing 

Threat actors are increasingly using AI to ramp up the scale and sophistication of their attacks. Vishing is among the common tactics that could become more convincing and easier to execute with AI at threat actors’ disposal. 

For example, AI accelerates victim selection and information gathering on intended targets. “The time for that process has just completely contracted. That process could take, say, 10 hours or 20 hours before. Now, it’s down to minutes,” Horwitz said.

Threat actors also no longer need to speak the same language as their targets. Voice recognition, particularly with the advent of deepfakes, is no longer a reliable source of identity verification.

“Even if they’re non-English speaking, they have the ability now with AI to make some pretty convincing scripts to target individuals,” Horwitz said. 

The help desk is the frontline of defense against vishing attacks

IT help desks are frequently the entry point for threat actors leveraging vishing.

“The help desk is arguably the single most important aspect of how you can improve your processes and your technologies in terms of being able to prevent these attacks,” Horwitz said.

Simulations that include vishing, not just traditional email-based or text-based phishing, could help strengthen employee preparedness, according to Horwitz.

“I haven’t seen a lot of emphasis on doing vishing simulations,” he shared. “As the threat level rises and there’s more and more instances of these things, I think organizations should look to improve their simulations around that area.”

Weiss also emphasized the importance of adopting phishing-resistant authentication as threat actors look to pressure users into giving them access to tokens to bypass MFA. 

“I would suggest strengthening help desk identity verification and the MFA reset procedures,” he said.

Industry defenders are fighting back and disrupting vishing and phishing operations  

ShinyHunters is responsible not only for attacks on healthcare organizations but also for theft of data from the Federal Bureau of Investigation (FBI). The FBI recently arrested a suspect thought to be involved in the hack on the federal agency, The New York Times reports.

In addition to that law enforcement activity, Microsoft and Health-ISAC recently collaborated to dismantle three cybercrime marketplaces that sold phishing services. 

While actions like these disrupt cybercriminal activity, healthcare organizations remain vulnerable to vishing campaigns, as well as other common attack vectors. Weiss stressed the importance of information sharing within the healthcare sector.

“A hospital acting alone cannot stay ahead of all of these threats and new tactics that are being developed every day,” he said.

Carrie Pallardy, a Chicago-based freelance writer and editor, began her career covering healthcare more than a decade ago. Her work has taken into many different industries, but covering healthcare delivery remains a constant focus. She can be reached at [email protected] or on LinkedIn.