Epic MyChart Phishing Campaign Hits U.S. Health Systems: Detection and Defense Guide for Healthcare Security Teams

More than a dozen U.S. health care systems have issued warnings to patients about an ongoing social engineering campaign that impersonates Epic MyChart — the patient portal platform used by the majority of large health systems in the country. Attackers are sending fraudulent emails designed to look like legitimate MyChart notifications, luring patients to credential-harvesting pages that mimic real portal login screens.

This is not a vulnerability in Epic software. It is a classic brand-impersonation and credential phishing operation — but the target selection is deliberate and dangerous. Patient portal credentials unlock protected health information (PHI), appointment histories, prescription data, billing details, and in many configurations, the ability to message providers or change demographic and payment information. For health systems, a compromised patient account is a HIPAA reportable event waiting to happen, and at scale, these campaigns create real breach-notification exposure under the HIPAA Breach Notification Rule.

For SOC teams supporting healthcare organizations, this campaign warrants immediate action: hunt for lookalike domain infrastructure, review portal authentication telemetry, and coordinate with patient communications teams before the help desk gets buried in calls.

Technical Analysis

What is being attacked

• Target: Patients of U.S. health systems using Epic MyChart
• Vector: Fraudulent emails impersonating MyChart notifications (e.g., new test results, billing statements, account verification, or password reset prompts)
• Objective: Harvest patient portal credentials via cloned MyChart login pages hosted on attacker-controlled lookalike domains
• Affected population: Any health system whose branding is spoofed — the campaign has prompted warnings from more than a dozen systems, indicating broad, opportunistic targeting rather than a single-victim operation

How the attack chain works

From a defender's perspective, the kill chain follows a well-understood pattern:

1. Delivery: Phishing emails are sent with MyChart-themed lures. Because MyChart sends legitimate automated notifications (new results, messages, billing), users are conditioned to click. Sender addresses are typically spoofed display names ("MyChart Support," "Epic MyChart") rather than legitimate health system domains authenticated via SPF/DKIM/DMARC.
2. Redirection: Links route to attacker infrastructure — frequently typosquatted or homoglyph domains (e.g., mychart-login.com, mychart-portal.net, or subdomain tricks like mychart.hospital-name.verify-account.com) or compromised legitimate sites used as redirectors.
3. Harvesting: The landing page clones the target health system's actual MyChart login page — often pulled live via a reverse-proxy phishing kit, which can also relay MFA challenges in real time (adversary-in-the-middle, MITRE ATT&CK T1557).
4. Account use: Captured credentials are used to access patient accounts, scrape PHI, alter payment/demographic details, or pivot into further fraud (prescription scams, insurance fraud, identity theft).

Exploitation status

This is a confirmed, active, in-the-wild social engineering campaign with warnings issued by multiple health systems. There is no CVE — this is not a software defect, so no patch exists. Defense rests entirely on identity controls, email security, domain monitoring, and user awareness. Because Epic MyChart serves a large share of the U.S. patient population, defenders should assume this campaign or copycats will persist.

Detection & Response

A note before the rules: patient-facing portal traffic largely happens outside your corporate perimeter — your patients aren't on your EDR. The highest-fidelity detections available to a health system SOC are (1) lookalike domain discovery and blocking, (2) internal email and proxy telemetry catching staff-targeted variants or patients reporting messages, and (3) anomalous authentication patterns on the MyChart platform itself (impossible travel, datacenter ASN logins, password-spray patterns). The rules below target those observable layers.

SIGMA Rules

---
title: Lookalike MyChart Domain DNS or Web Access
description: Detects DNS queries or web proxy requests to suspected MyChart typosquat or lookalike domains used in patient portal phishing campaigns. Baseline your legitimate MyChart/portal domains and tune the filter accordingly.
logsource:
  category: dns
detection:
  selection:
    query|contains:
      - 'mychart'
      - 'my-chart'
      - 'myepic'
      - 'epicmychart'
      - 'epic-mychart'
  filter_legitimate:
    query|contains:
      - 'mychart.epic.com'
      - 'mychart.com'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate regional health system MyChart subdomains - maintain an allowlist of known-good patient portal FQDNs
level: medium
---
title: MyChart-Themed Phishing Email Subject Pattern
description: Detects inbound email subjects matching common patient-portal phishing lures impersonating MyChart notifications from external senders that fail authentication or come from non-health-system domains.
logsource:
  category: email
detection:
  selection_subject:
    Subject|contains:
      - 'MyChart'
  selection_lure:
    Subject|contains:
      - 'verify your account'
      - 'account suspended'
      - 'unusual sign-in'
      - 'confirm your identity'
      - 'billing statement'
      - 'new test result'
      - 'action required'
      - 'update your information'
  condition: selection_subject and selection_lure
falsepositives:
  - Legitimate MyChart automated notifications - correlate with sender domain, SPF/DKIM/DMARC results, and known health-system sending infrastructure
level: medium
---
title: Potential Credential Harvesting Page Followed by Authentication Anomaly
description: Detects a user browsing to a suspected lookalike portal domain followed by password reset or login failure activity, which may indicate a phished user attempting or failing to authenticate.
logsource:
  category: webserver
  product: windows
detection:
  selection:
    cs-uri-query|contains:
      - 'mychart'
      - 'patientportal'
      - 'portal-login'
    sc-status:
      - 401
      - 403
  condition: selection
falsepositives:
  - Legitimate failed logins to the real portal - scope this rule to reverse-proxy or WAF logs in front of the actual MyChart instance
level: low

KQL — Microsoft Sentinel / Defender

The following hunts target email delivery, URL clicks, and proxy/DNS telemetry for MyChart lookalike infrastructure. Update the allowlist with your organization's real portal domains before running in production.

// Hunt 1: Inbound emails with MyChart-themed lures from external/unauthenticated senders
EmailEvents
| where Timestamp > ago(14d)
| where Subject has "mychart" or Subject has "patient portal"
| where SenderFromDomain !in~ ("yourhealthsystem.org", "epic.com")
| project Timestamp, SenderFromAddress, SenderFromDomain, Subject, RecipientEmailAddress, AuthenticationDetails, DeliveryAction, ThreatTypes
| order by Timestamp desc;

// Hunt 2: URL clicks on suspected MyChart lookalike domains (Defender for Office 365)
UrlClickEvents
| where Timestamp > ago(14d)
| where Url has_any ("mychart", "my-chart", "myepic")
| where Url !has_any ("yourhealthsystem.org", "mychart.epic.com")
| project Timestamp, AccountUpn, Url, UrlChain, ActionType, IsClickedThrough, ThreatTypes
| order by Timestamp desc;

// Hunt 3: Proxy/firewall egress to lookalike portal domains via CommonSecurityLog
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where (isnotempty(DestinationHostName) and DestinationHostName has_any ("mychart", "my-chart"))
   or (isnotempty(RequestURL) and RequestURL has_any ("mychart", "my-chart"))
| where coalesce(DestinationHostName, RequestURL) !has "yourhealthsystem.org"
| summarize Hits=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)
  by SourceIP, DestinationHostName, RequestURL
| order by Hits desc;

// Hunt 4: Password spray / anomalous authentication against patient portal or related IdP
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName has_any ("MyChart", "Patient Portal") or ResourceDisplayName has_any ("MyChart")
| summarize Attempts=count(), Failures=countif(ResultType != 0), DistinctUsers=dcount(UserPrincipalName),
    Locations=dcount(Location), ASNs=dcount(NetworkLocationDetails)
  by IPAddress, bin(TimeGenerated, 1h)
| where Failures > 10 or DistinctUsers > 5
| order by Failures desc;

Velociraptor VQL — Endpoint Browser Artifact Hunt

For staff workstations or shared clinical workstations where a user may have clicked a phishing link, hunt browser history for visits to lookalike MyChart domains. This supports scoping during IR after a patient or employee reports a suspicious message.

-- Hunt Chrome/Edge browser history for visits to suspected MyChart lookalike domains
SELECT FullPath, URL, Title, LastVisitTime,
       upload(file=FullPath) as HistoryFile
FROM glob(globs='''C:/Users/*/AppData/Local/Google/Chrome/User Data/*/History''')
WHERE URL =~ '(?i)mychart|my-chart|myepic'
  AND URL !~ '(?i)yourhealthsystem\.org|mychart\.epic\.com'
ORDER BY LastVisitTime DESC

Remediation & Hardening Script

This PowerShell script helps Microsoft 365–based health systems take immediate action: block known lookalike domains at the tenant level, audit for malicious inbox rules created after credential theft, and export recent MyChart-themed phishing mail for review. Populate $BlockDomains with lookalike domains identified through your threat intel or brand-protection monitoring.

# Requires: ExchangeOnlineManagement, Microsoft.Graph modules
# Run with Exchange Admin + Security Admin rights

$BlockDomains = @("mychart-login.com", "mychart-verify.net", "mychart-portal-secure.com")  # Update with observed lookalikes

# 1. Add lookalike domains to the Tenant Allow/Block List (blocks mail + Teams/URL where supported)
foreach ($d in $BlockDomains) {
  New-TenantAllowBlockListItems -ListType Url -Block -Entries "*.$d/*" -ExpirationDate (Get-Date).AddDays(90) -Notes "MyChart phishing campaign"
  New-TenantAllowBlockListItems -ListType Sender -Block -Entries "*@$d" -ExpirationDate (Get-Date).AddDays(90) -Notes "MyChart phishing campaign"
}

# 2. Purge delivered MyChart-themed phishing mail still sitting in inboxes
$phish = Get-MessageTrace -StartDate (Get-Date).AddDays(-10) -EndDate (Get-Date) |
  Where-Object { $_.Subject -match "(?i)mychart" -and $_.SenderAddress -notmatch "yourhealthsystem\.org|epic\.com" }
$phish | Export-Csv -Path ".\MyChart_PhishTrace_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
# Review the CSV, then use Compliance Search / eDiscovery purge for confirmed malicious messages

# 3. Audit for suspicious inbox rules (common after credential theft - e.g., auto-delete/forward of portal mail)
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
  Get-InboxRule -Mailbox $_.PrimarySmtpAddress -ErrorAction SilentlyContinue |
    Where-Object { $_.DeleteMessage -eq $true -or $_.ForwardTo -ne $null -or $_.RedirectTo -ne $null } |
    Select-Object @{N='Mailbox';E={$_.MailboxOwnerId}}, Name, ForwardTo, RedirectTo, DeleteMessage, SubjectContainsWords
} | Export-Csv -Path ".\Suspicious_InboxRules_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation

# 4. Verify DMARC enforcement on your primary domain (patients should be able to trust your real mail)
Resolve-DnsName -Name "_dmarc.yourhealthsystem.org" -Type TXT | Select-Object Name, Strings
Write-Output "Confirm DMARC policy is p=reject and aggregate reports are monitored."

Remediation and Defensive Recommendations

There is no patch for social engineering. Remediation here is layered and operational:

1. Domain and brand protection: Register obvious typosquats of your portal domains; subscribe to certificate-transparency and new-domain monitoring (e.g., via your brand-protection vendor) to catch mychart-themed registrations referencing your health system name. Submit confirmed phishing domains to registrar/host takedown channels, Google Safe Browsing, Microsoft, and CISA's phishing reporting.
2. Email authentication enforcement: Ensure your health system's domains are at DMARC p=reject with aligned SPF and DKIM. This won't stop lookalike domains, but it prevents direct spoofing of your domain and gives patients a trustworthy signal. Use BIMI where feasible so legitimate messages carry your verified logo.
3. Patient portal authentication hardening: Enable and promote MFA for MyChart accounts; deploy Epic's available fraud/anomaly detection and rate-limit login attempts; alert on impossible-travel, datacenter-ASN, and high-velocity authentication failures. Coordinate with your Epic technical contact on current portal security configuration options.
4. Patient communication: Publish a standing advisory on your portal login page and social channels stating exactly what domains you send from and that you will never ask for credentials via email links. Give patients a single, easy reporting path (a phishing@ address and a phone line) and staff the help desk for increased volume.
5. HIPAA response readiness: Pre-stage your incident decision tree: define the threshold at which confirmed account compromises trigger breach risk assessment under 45 CFR §§ 164.400–414, and know your forensics path for determining what PHI was accessed in a compromised patient account.
6. Threat intel sharing: Share indicators with H-ISAC (Health Information Sharing and Analysis Center) and HHS HC3. Cross-health-system visibility is exactly what blunted awareness in this campaign — more than a dozen systems warning patients simultaneously is the model to sustain.

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub