- Статьи
- Society
- Doctor's Game: Russians are being attacked with fake messages from clinics during the SARS season
Doctor's Game: Russians are being attacked with fake messages from clinics during the SARS season
Against the background of an increase in the incidence of acute respiratory viral infections and influenza, attackers began to send fake notifications on behalf of clinics more often, informing them about the readiness of tests, the postponement of an appointment, or the need to urgently pay for services: in this way, scammers are trying to lure out personal and bank data. The links in the messages lead to phishing sites that mimic medical services. How to detect fraud and protect your money and data is in the Izvestia article.
How scammers operate
In the fall, scammers began to pose more often as employees of medical institutions. This is due, among other things, to the SARS and flu season, representatives of cybersecurity companies told Izvestia. According to the latest data from Rospotrebnadzor, over 614,000 cases of acute respiratory viral infections, influenza and COVID-19 were registered in Russia in the 43rd week of 2026.
"The incidence of influenza continues to grow," the ministry stressed.
Taking advantage of the situation, fraudsters can fake notifications about the readiness of tests and the postponement of a doctor's appointment to steal personal and bank data, Softline Group told Izvestia.
In addition, the attackers offer to confirm an appointment with a specialist, urgently pay for an appointment or get acquainted with the research results. To do this, they send messages with links that lead to fake pages that mimic the websites of clinics and medical services. There, users are asked for passwords to their personal accounts, personal information, or bank card information.
"Regular phishing is often based on the fear of losing money or access to an account," said Maxim Gryazev, head of the Digital Threat Analysis and Assessment Department at Softline Group (Infosecurity, part of Softline Solutions). — Here, the attackers use a more sensitive topic — health. The phrase about critical analysis indicators makes a person first open a link and only then think about who the message came from.
During the SARS season, scammers become more active, as people lose their vigilance due to poor health, turn to doctors more often, take tests and wait for reports on the results, confirmed Viktor Ievlev, director of information security at the Garda company.
— Scammers apply pressure: they demand to immediately click on the link, pay for the reception or give the code from the SMS, — the expert added. — I recommend that you call the registry yourself or check the information through the official application or the clinic's website.
What other schemes are used?
Fraudsters send information on behalf of medical institutions not only during the SARS season, said Alexander Vurasko, Director of Development at the Solar AURA External Digital Threat Monitoring Center at Solar Group.
For example, in February 2026, the scammers posed as employees of the Leningrad Clinical Hospital and referred to the results of the patient's tests.
"A medical legend is convenient because it coincides with a real—life situation: a person can actually wait for an examination, appointment, or results," he said. — In this case, an unexpected message looks more convincing than a regular mailing list.
Very often, attackers send fake test results with malicious files, messages with links to confirm the postponement of the appointment and extend the attachment to the clinic, Viktor Ievlev recalled.
— Sometimes they call for persuasiveness, for example, with offers to undergo a free medical examination or vaccination and ask you to give the SMS code for booking an appointment, — said the expert. — Under such pretexts, people are lured to phishing sites, steal data, or try to gain access to "Public Services."
Another stable legend is the urgent replacement or extension of the compulsory medical insurance policy, noted Alexander Vurasko. In July 2026, people were sent the details of their current policy and, under the pretext of updating the information, they requested a digital code. Here, real information is used to confirm a fictional need to do something urgently.
—Scammers also use health fears to extort money," the expert said. "They report allegedly poor test results, and then connect the "chief physician" or "professor" who convince the person to urgently pay for expensive treatment. Therefore, questionable results should be checked directly at your clinic, rather than agreeing to buy drugs on the advice of strangers.
People's trust in medical professionals and users' desire to help is also being actively exploited, said Olga Altukhova, senior content analyst at Kaspersky Lab.
—For example, under the guise of "Best Doctor" or "Top 10 Nurses and Nursing Doctors" contests, they launch fake voting with photos of supposedly real doctors and vote counters in order to elicit an emotional response," she said. — Clicking on the "Vote" button leads to the phishing page of a popular messenger, where the user is asked to log in through an account to steal accounts, send spam or subsequent targeted attacks.
How to distinguish a fake
All these schemes have one thing in common: fraudsters are trying to force a person to urgently transfer money or disclose account data under the pretext of taking care of their health, Alexander Vurasko noted. The expert advises checking medical information directly at the clinic, and the authenticity of messages through its official communication channels.
According to him, it is important to make sure not only that the clinic exists, but also that the message was actually sent on its behalf. Fraudsters can copy the name and logo of a real medical institution, as well as indicate the names of real doctors. Therefore, such details do not confirm the authenticity of the notification.
— Of course, the message about the readiness of the tests is not in itself a sign of deception: real laboratories do use SMS and e—mail to inform patients, - he stressed. — To dispel all doubts, you need to open the usual application or personal account of the clinic yourself, or call the number specified in the contract or on the official website, and not in the suspicious mailing list. The recording status, the availability of the results, and the need for payment should be clarified there.
It is especially important to pay attention to what the other person requires of you, the expert added. To transfer the record, you do not need to dictate the login code to the bank or to Gosuslugi.
— You need to read the purpose of the code in the message itself, and not rely on the caller's explanation, — said Alexander Vurasko. — We have repeatedly documented a scheme in which, under the pretext of making appointments for tests, patients were lured out of codes for access to the state portal.
Also, in order not to become a victim of intruders, you should not follow links from unverified chats and emails, you do not need to enter usernames and passwords on third-party resources, and all suspicious votes should be reported to the administration of medical institutions, Olga Altukhova emphasized.
"It would not be superfluous to install security software that blocks attempts to access phishing sites and download malicious files," she said.
Softline emphasized that medical organizations should inform patients in advance from which addresses notifications are received, which information the clinic never requests in letters, and where to independently verify the received message.
Переведено сервисом «Яндекс Переводчик»
