Health-ISAC

Healthcare information sharing body that warned members about rising ShinyHunters social engineering against corporate cloud and SaaS accounts.

Known aliases

Health Information Sharing and Analysis Center

Current stories

productConfirmed3 publishers

Microsoft disables 20,000 accounts tied to Yam Store, a phishing kit marketplace

Microsoft and international partners dismantled the Yam Store phishing marketplace, whose kits enabled more than 1 billion malicious messages. Microsoft says buyers could deploy the pre-made kits very quickly, so a polished lure says little about the sender's skill.

Publishers:computerworld.com techtimes.com theverge.com

Perspective Coverage

3 publishers

Builder: Builder 20%
Operator: Operator 63%
Investor: Investor 17%

Reality

Evidence58
Adoption: Insufficient
Hype gap+15
Incentives50
Confidence68

buildOne report1 publisher

ShinyHunters-linked crews take Okta with a phone call and a rogue MFA device, Health-ISAC warns

Health-ISAC warned members in September 2026 that ShinyHunters-linked crews extort healthcare without encrypting files, in one case taking over 1TB. A dev.to write-up of the warning points to new factor enrollments and bulk exports as the signals to watch.

Publishers:dev.to

Reality

Evidence50
Adoption: Insufficient
Hype gap+10
Incentives: Insufficient
Confidence50

securityConfirmed11 publishers

Civil suit lets Microsoft and Health-ISAC seize domains behind more than 1 billion phishing messages

Microsoft and Health-ISAC seized domains behind YAM Store, CoGUI and Iron Man, phishing services tied to more than 1 billion messages since January. Microsoft's Steven Masada wrote that the three are only part of a larger criminal network.

Publishers:blogs.microsoft.com cyberscoop.com esecurityplanet.com hackread.com helpnetsecurity.com infosecurity-magazine.com microsoft.com securityweek.com thecyberexpress.com thehackernews.com therecord.media

Perspective Coverage

11 publishers

Builder: Builder 18%
Operator: Operator 63%
Investor: Investor 19%

Reality

Evidence62
Adoption60
Hype gap+15
Incentives55
Confidence70

securityConfirmed9 publishers

McKesson's 8-K locates the stolen data inside third-party applications

The distributor found the intrusion on August 25, 2026, the same day ShinyHunters says its four-day exfiltration ended. It has not named the vendor applications involved, so customers are left scoping their own integrations.

Publishers:bleepingcomputer.com cyberscoop.com helpnetsecurity.com infosecurity-magazine.com malwarebytes.com mckesson.com scworld.com securityweek.com therecord.media

Perspective Coverage

9 publishers

Builder: Builder 17%
Operator: Operator 66%
Investor: Investor 17%

Reality

Evidence50
Adoption: Insufficient
Hype gap+40
Incentives70
Confidence55

securityConfirmed8 publishers

EvilTokens rented an AI-powered inbox-scanning tool and a device-code MFA bypass for a $1,500 fee plus $500 a month

Microsoft's Digital Crimes Unit and its partners pulled down the EvilTokens phishing service about seven months after it launched, and British police arrested its two suspected operators. The authentication technique it sold survives on other platforms.

Publishers:bleepingcomputer.com cyberscoop.com helpnetsecurity.com microsoft.com securityaffairs.com securityweek.com thehackernews.com therecord.media

Perspective Coverage

8 publishers

Builder: Builder 25%
Operator: Operator 60%
Investor: Investor 15%

Reality

Evidence66
Adoption58
Hype gap+18
Incentives62
Confidence64