Saturday, August 29, 2026

1. Signal of the Day · Security & AI Risk

   Phishing kit impersonates an "AI-powered review" to scare patients into installing malware

   Epic has published a step-by-step teardown of two live phishing campaigns against MyChart patients: a cloned sign-in page at lookalike domains harvests credentials, then a fake chart displays a pop-up claiming an "AI-powered review" found critical patterns in the patient's blood work, using that urgency to walk the victim through keystrokes that run a clipboard payload — with an August 2026 variant swapping in a downloadable "Unlock Full Report & See Diagnosis" executable, and a companion campaign harvesting card details behind a free "2026 Medicare Health Kit." Healthcare technology leaders should note the inversion: this is not an AI system failing, it is legitimate AI adoption being borrowed as an authentication signal, and every genuine "our portal now uses AI to flag results" message makes the counterfeit more plausible. With Medicare-branded lures aimed squarely at older adults and the family members who manage portals for them, SNF and senior living operators should define which channels will and will not carry AI-generated clinical findings before deploying patient-facing AI, not after the first counterfeit arrives.

   HighBy MyChart / EpicRead at source ↗

2. SNF / Post-Acute

   MedPAC devotes a September session to post-acute use in fee-for-service versus Medicare Advantage

   The Commission's September 3-4 public meeting agenda sets two back-to-back Friday sessions: "Examining use of post-acute care services by beneficiaries in fee-for-service Medicare and Medicare Advantage," where commissioners will review initial findings from an analysis of acute care hospital and post-acute use by both populations, and "Accuracy of Medicare Advantage risk adjustment at the plan level." The agenda contains no reference to artificial intelligence, algorithms, or prior authorization, and that is worth stating plainly rather than letting readers assume otherwise. What it does address is the underlying empirical question of whether Medicare Advantage enrollees receive less post-acute care than fee-for-service enrollees — the foundation on which every algorithmic-denial argument ultimately rests. A commission finding here would shape the long-run policy debate more than another round of trade coverage.

   MedBy MedPACRead at source ↗

3. Security & AI Risk

   DOJ and FBI seize two PRC intrusion platforms that targeted HHS and NIH — and it is not an AI story

   Court-authorized seizures in the Southern District of California rendered QScan and QTRouter inoperable; the platforms were built and operated by PRC state-sponsored group QTFY and used against NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health and the U.S. Senate. QScan scanned for vulnerable IoT devices and exploited them with hundreds of pre-coded exploits; QTRouter chained compromised devices, commercial proxies and leased virtual private servers to obfuscate intrusion origin, and the seized domains were hard-coded into both malware families. The FBI and NSA published a companion advisory with indicators of compromise reaching back to 2018. The "bot-like platform" framing in coverage should not be read as artificial intelligence — this is automated scanning and proxy obfuscation, and mislabeling it is how an AI risk register fills up with things that are not AI risks.

   MedBy Andrea Fox · Healthcare IT NewsRead at source ↗

4. Security & AI Risk

   AHA flags the MyChart phishing campaign to hospitals sector-wide

   The American Hospital Association carried Epic's warning into sector advisory channels on August 24, citing fake MyChart sites displaying erroneous medical records and fraudulent "2026 Medicare Health Kit" offers. Worth noting for anyone tracking how quickly a patient-facing threat reaches provider security teams: the AHA summary does not mention the fake "AI-powered review" pop-up at all, which appears only in the vendor's own teardown — a reminder that the AI-specific detail in a security advisory is often the first thing lost in summarization.

   MedBy AHARead at source ↗

Get the Daily Dispatch by email · free, about 8 a.m. Eastern · RSS