Microsoft warns of sophisticated phishing campaign heavily targeting health care organizations | AHA News - American Hospital Association

May 08, 2026 - 11:00 AM Microsoft Threat Intelligence is warning of a large scale, multistage phishing campaign that disproportionately targeted the health care sector, sending “code of conduct” themed emails to lure users into credential theft and token compromise. According to Microsoft, health care was the most targeted industry in the campaign, which reached more than 35,000 users across over 13,000 organizations, primarily in the U.S. The attack leveraged adversary in the middle techniques to intercept authentication tokens in real time, enabling attackers to bypass multifactor authentication and gain direct account access.   “Phishing attacks are the most frequent and most effective methods of attacking the health care sector,” said Scott Gee, AHA deputy national director for cybersecurity and risk. “Training and vigilance are the keys to preventing these attacks. That training should also emphasize the ‘why.’ It’s not just about loss of protected health information, but the potential for shutting down critical systems and impacting patient care and safety.”  Microsoft said the campaign underscores the sector’s continued attractiveness to cybercriminals due to sensitive patient data and operational pressures, and it urged hospitals and health systems to strengthen phishing resistant MFA, email security controls and workforce awareness to reduce risk.   For more information on this or other cyber and risk issues, contact Gee at sgee@aha.org or John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.  Cybersecurity HEADLINE Agencies issue joint statement on AI and increased cyber risk Leaders of the Five Eyes cybersecurity agencies, consisting of Australia, Canada, New Zealand, the United Kingdom and the United States, released a joint… HEADLINE Administration releases memo on cybersecurity governance for national security systems President Trump issued a memorandum June 12 on cybersecurity governance for national security systems used by federal agencies. The memo re-establishes and… HEADLINE Automatic tank gauge systems targeted by cyber actors, agencies warn The Cybersecurity and Infrastructure Security Agency and other federal agencies released a fact sheet June 2 on malicious cyber activity targeting U.S.-based… HEADLINE Alert warns of cyber campaign by Chinese military intelligence to obtain classified or privileged information The FBI and international agencies have released an alert on Chinese military intelligence services using professional networking sites and online job… HEADLINE White House issues executive order on cybersecurity for AI The White House issued an executive order June 2 on cybersecurity efforts regarding artificial intelligence. The order instructs federal… HEADLINE Guide issued for healthcare organizations on cyber governance frameworks for secure AI implementation  The Health Sector Coordinating Council’s Cybersecurity Working Group has released a guide to help healthcare organizations establish cyber governance…