SECURITY researchers have identified an active AiTM phishing operation targeting healthcare organisations, including hospitals, medical schools and related institutions. The campaign stole session tokens by compromising university accounts that sent document-sharing notifications to partner health systems. Victims who clicked phishing links were directed to a staging page on Google Sites before being redirected to a harvester domain that captured credentials and authentication cookies in real time.
The activity sequence enabled attackers to chain compromised accounts, with anomalous sign-ins appearing from unusual networks and, about seven hours after initial access, the attackers used the harvested sessions to send over 1,000 phishing emails to external educational domains in just 13 minutes. The effort also carried a parallel malware track, with some links delivering ConnectWise ScreenConnect installers to gain persistent unauthorised administrative access.
Security Risk Advisors assess with moderate confidence that the operation employs the Sneaky 2FA phishing kit, sold under the Sneaky Log phishing-as-a-service brand. The kit acts as a reverse proxy between victims and legitimate login portals, replaying stolen session tokens so the second factor is not re-challenged and password resets do not evict attackers. Operators cloak infrastructure to appear benign to scanners, which has helped the domains appear clean to reputation services.
In total, 1,454 unique recipients across 565 domains faced the campaign, with healthcare providers representing about 47% of targets and higher education a further 13%.
References to ongoing mitigations include revoking active session tokens immediately, deploying phishing-resistant MFA such as FIDO2 keys or certificate-based authentication, and restricting unapproved remote access tools. The report also notes potential links to the broader ecosystem of AiTM tooling, including cross-domain chaining across healthcare and academic networks. CVE-2026-85046 is cited among actively exploited vulnerabilities in the wild; further CVEs are listed in the linked CVE Watchtower feed.
The update underscores the need for layered identity controls and strict software allow-lists to curb credential theft and remote access abuse.