Recent Healthcare Cyber Attacks

Google says attackers are using fake application portals to trick LLM users into handing over active access tokens, allowing criminals to use expensive AI services on the victim’s account. In a separate campaign, unauthorized AI-tool resellers instructed employees to run a one-line setup command…

Russian authorities arrested three suspected members of VasyGrek, also known as Fluffy Wolf, a financially motivated group that used targeted phishing to access corporate systems and steal money. In one documented case, an accounting employee opened a malicious attachment disguised as a routine…

A real campaign called Yoba used fake GitHub projects for supposed ChatGPT and Claude desktop applications to lure people into downloading malicious ZIP installers. The installers included legitimate signed OpenAI or Anthropic programs alongside malicious files, ultimately installing a…

A gray-market service persuaded employees to install genuine OpenAI Codex and Anthropic Claude Code tools, then run a follow-up setup command that redirected the tools through relay servers it controlled. The configuration changes could expose every prompt, file, and login token sent through the…

The Yoba malware campaign uses fake GitHub projects and search-result manipulation to make counterfeit ChatGPT and Claude downloads look trustworthy. Victims receive a real, signed installer alongside malware, so the application appears legitimate while the malicious software installs and…

Cisco Talos investigated a VYPR ransomware incident in which an attacker used a voice-phishing call to trick a user into starting a Microsoft Quick Assist remote-support session. Talos also observed IT help desk impersonation in several other incidents, showing that a seemingly routine support call…

After a ransomware attack disrupted University of New Mexico healthcare services, the BYOD ransomware group allegedly offered free decryption keys but said it would retain stolen patient and employee data. The group told affected people to contact it directly and pay $2,500 to have personal…

Rhode Island alleges that Meta profited from scam advertising that used targeted delivery to reach vulnerable users, including older adults. Reported lures included fake Alzheimer’s and diabetes cures, misleading health products, and investment scams using deepfaked public figures such as Elon…

The Skyw4lker campaign targets U.S. manufacturing, technology, and healthcare organizations with password-protected documents disguised as contracts or service proposals. Victims are sent through a Google-hosted page into a legitimate Microsoft authentication process, where completing an…

South Korean police say a suspected hacker breached 60 organizations and stole personal and business data, then used the threat of public disclosure to demand payment. The group reportedly sent extortion emails and escalated to calls and text messages to executives and employees when organizations…

Microsoft is adding AI-based phishing detection to Teams after attackers repeatedly used external chats to impersonate support staff, send malicious files, and deliver fake billing notices. The reported attacks exploit Teams' default external-access feature rather than a software flaw, making…

A cyberattack disrupted University of New Mexico Health hospitals, forcing ambulance diversions and canceled clinical appointments. During the incident, attackers reportedly played a synthetic voice message on hospital workers’ computers claiming they had stolen sensitive data and directing…

The article recounts the real ILOVEYOU worm outbreak, which used a romantic email subject line and a supposed love-letter attachment to trick millions of recipients into infecting their computers. Once opened, the attachment spread the same message to everyone in the victim's address book, showing…

TransUnion reports that criminals are using trusted brands and compromised customer information to trick people into sharing details, one-time passcodes, or access to their accounts. The scams exploit normal-looking security requests and can lead to account takeovers, redirected payments, and…

Employers are encountering fraudulent job candidates who use real-time face swaps and cloned audio to pass remote interviews, then send a different person to onboarding. The article describes this as a real and growing hiring-fraud problem, especially for high-access technology and defense roles,…

Researchers uncovered an AI-assisted ransomware operation linked to affiliates of INC and The Gentlemen. After breaking into organizations through exposed remote-access systems, the group stole sensitive files and used scripted phone calls, proof samples, and threats to contact customers or…

Proofpoint described real campaigns where attackers used highly tailored, AI-style messages to make phishing and payment fraud requests appear routine. Examples included property enquiries that led to malicious meeting invitations, device-code phishing pages disguised as business services, and fake…

Researchers uncovered exposed infrastructure allegedly used by affiliates of INC Ransomware and The Gentlemen Ransomware. Alongside device exploits and ransomware tooling, the records describe a practical extortion workflow: direct emails to owners or executives, followed by voice calls, pressure…

Federal investigators are examining alleged links between ShinyHunters and ransomware negotiation executives. The article also documents a real Dharma ransomware exchange in which the attacker steered a victim toward an alleged Canadian IT intermediary, using a reassuring “guarantees” offer to keep…

This article describes a real and growing social-engineering technique called ClickFix, where attackers disguise malicious instructions as a familiar CAPTCHA or verification step. In one documented case, a fake free image-editing tool prompted victims to run code that installed malware designed to…