What Changed
In the latest quarterly review, researchers identified repeated campaign bursts against hospital and outpatient administrators during shift transitions and month-end billing periods. Subject lines frequently referenced compliance notices, credential expiry, and patient payment remittance.
Operational Impact
Although attachment malware rates were lower than previous quarters, credential theft landing pages increased significantly. Incident responders linked several clusters to infrastructure that rotated domains every 24 to 48 hours, frustrating blocklist-only defenses.
Response Priorities
Organizations with regular role-based phishing awareness drills reported faster internal escalation and lower click-through rates. Teams that combined training with mailbox reporting automation generated cleaner telemetry for SOC triage.