Healthcare Phishing Teardowns

Every Attack of the Day teardown where the targeted organization was in healthcare, newest first. Real attacks on healthcare organizations, dissected: the headers, the lure, and why it got past the first line of defense. Targeted organizations are never named.

All teardownsEducationManufacturingFilter in the ExplorerHealthcare email security

2026

• One Target List, Six Weeks of Conference Invites2026-08-31
• Nothing to Block: A 1990s Domain and a Google Form2026-08-29
• The Phishing Email That Read Backwards in Its Own Source2026-08-24
• Perfect Authentication, Borrowed From a Real Mailbox2026-08-20
• The Redirect That Lied About Its Own Destination2026-08-18
• Mexico's Tax Authority, Sent From a Yahoo Account2026-08-16
• One Extra Letter, Full Auth Pass, Nothing to Scan2026-08-13
• Two Brands in One Message, One URL Built at Runtime2026-08-12
• Known Sender, Perfect Auth, Confirmed Malicious Link2026-08-10
• The SharePoint Lure That Never Touched Microsoft2026-08-07
• Every e, o, and p Was Cyrillic. The Adobe Logo Was Real.2026-08-06
• Two Invoices, One Reference ID, and a $4.8 Trillion Typo2026-08-05
• A DMARC Pass With No SPF, and a CTA Full of Hidden Letters2026-08-02
• Even the Unsubscribe Link Installed a Remote-Access Tool2026-08-01
• Interactive Brokers W-8BEN Lure Hid Behind a 0-Day Domain2026-07-30
• Forged Healthcare Sender, Two-Hop SaaS Redirect: How a Fake Invoice Opens a Phishing Chain2026-06-27
• The Government Card Alert That Lost Its Authentication in Transit2026-06-19
• A Medicare Attestation Request Sent Through Salesforce, Authenticated by the Victim's Own Domain2026-06-13
• The Geek Squad Invoice That Forgot Which Brand It Was Pretending to Be2026-06-11
• The PDF That Passed Every Scan Without Being Read2026-06-04
• The $47,320 Invoice That Came With a W-9 and a Personal Bank Account2026-05-29
• The Spreadsheet That Arrived Twice: CR/LF Filename Obfuscation and a Base64 Shadow Payload2026-05-18
• The Bank Statement You Had to Unlock With Your Birthday: PII-Gated PDF Evasion From Authenticated Infrastructure2026-05-17
• The Unsubscribe Button Was the Payload: How a Fake Health Email Weaponized Opt-Out Compliance2026-05-05
• Past Due Invoice, Future Wire Fraud: How a BEC Campaign Passed Every Authentication Check2026-04-16
• The Meeting Invite That Knew Your Email Address2026-03-27
• The Restaurant Booking Platform That Validated Your Inbox Before the Attack Began2026-03-11
• The Lab Result Notification That Every Security Check Approved (Because the Platform Was Real)2026-03-10
• The Law Firm Name That Used Invisible Characters to Pass Authentication2026-02-26
• The Phishing Simulation Platform That Powered a Real Attack2026-02-24

2025

• The Credential Page Was Real. The Domain Was One Extension Off.2025-12-30
• A 16-Day-Old Domain, Zero Links, and One Phone Number: Anatomy of a Pure TOAD Attack2025-12-18
• Nested RFC822 Attachment with No DKIM or DMARC Signals Thread Hijack via Internal Routing2025-12-03
• Compromised .gov SharePoint Tenant Delivers Credential Harvest via Tokenized Links2025-12-01
• Wire Transfer PDF Invoice Passes DLP Gateway with Full Email Authentication2025-11-28
• Self-Addressed and BCC'd: A Compromised Hospital Account Delivered Encrypted PDFs at Scale2025-11-05
• Facebook Share Notification Abuses Legitimate Infrastructure to Target Corporate Inboxes2025-11-02
• The Invoice Attachment Was Empty. The Attack Was Not.2025-10-30
• The SendGrid Email That Came From a Window Company2025-10-28
• The Vendor Address Hiding in Plain Sight: How a Free Email Service Carried a B2B Impersonation Into a Real Thread2025-10-15
• The Phishing Relay Running on Government Cloud Infrastructure2025-10-12
• The Shared File Card That Was Actually a PNG: Image-Based Microsoft 365 Credential Harvesting2025-09-09
• Voicemail Lure Hides Behind Microsoft Dynamics CRM and Three Mismatched Domains2025-09-08
• Google Sent This Email. The Law Firm Spelled with Cyrillic Letters Did Not.2025-08-01
• The Silent Read: VERP Bounce Sender and a Personal Gmail Read-Receipt Channel in a DMV Impersonation2025-07-11
• Colleague-Confirmed Fraud: When the Invoice Already Has an Internal Warning Attached2025-07-04
• SendGrid as the Delivery Rail, sendgrid-verify[.]com as the Trap2025-06-29
• Voicemail Phish Abuses Microsoft Dynamics 365 Marketing Host to Deliver CEO-Targeted CTA2025-06-20
• The "Access Code" That Passed Every Authentication Check2025-04-23
• A Friend's Sick Daughter and a Gift Card: The BEC Attack That Left No Evidence for Scanners2025-04-02
• When Your Vendor's Email Account Sends You Malware2025-03-23
• AV Said This PDF Was Clean. It Was Wired to Fire a Google Script the Second You Opened It.2025-03-21
• The Invoice Hidden in Your Calendar: .ics Payment Fraud2025-03-13
• The Calendar Invite Google Signed for the Attacker2025-02-20
• Fake Xerox Receipt, No File, Two Reply Mailboxes2025-02-16
• McAfee Renewal Scam Sent Under the Victim's Own Name2025-02-15
• A Zix Secure Message Alert That Opened a ClickUp Form2025-02-09
• A Microsoft Renewal Scam With a Phone Number Payload2025-01-29
• A Fake Secure Message From Your Own IT Security Team2025-01-28
• Dropbox Email, DocuSign Form, One Raw S3 Bucket2025-01-20
• A Real Demio Invite Hid a $969 Crypto Payment Scam2025-01-11
• Everything In This Email Was Real Except One Link2025-01-05
• The Fake Login That Sends You to the Real Microsoft2025-01-02

2024

• A Days-Old Domain Sent a Calendar Invite From Yourself2024-12-21
• A Fake Attorney, Your Real SSN, and a $697 Demand2024-12-16
• A Credential Phish With No Attacker Domain to Block2024-11-26
• The Power BI Report That Was Really a Vishing Lure2024-11-15
• A Real File-Transfer Alert With a Throwaway Reply-To2024-10-23
• The Login-Expiry Lure That Spoofed No One2024-10-19
• The Leftover Footer Link That Unmasked an Invoice Scam2024-10-12
• Two Images, Zero Text: A Secure-Document Lure2024-10-08
• When a University's Own Domain Blasts a Job Scam2024-10-02
• The Email Addressed to Its Own Sender2024-08-28
• One JPEG, Two Attachments, Nothing to Scan2024-08-17
• A DKIM Signature That Pointed at No Key2024-08-13
• The Sender Was a Coworker and Nothing Looked Wrong2024-07-27
• The Forged Reply That Explained Why the Invoice Arrived2024-07-25
• An EY Forum Invoice With Someone Else's Bank Details2024-07-22
• The Attachment Card That Printed Its Own Emptiness2024-07-20
• Fabricated Invoice Thread BEC Rides a Compromised Mailbox2024-07-04
• The Phishing Page No Link Scanner Ever Saw2024-07-03
• Nothing to Block: A Phish With Perfect Authentication2024-06-30