NHIC Spam Harvesting Victim's Information

This report describes an ongoing spam/phishing campaign that impersonates the National Health Information Center (NHIC) and uses obfuscated JavaScript and fake enrollment pages to trick users into submitting personally identifiable information (PII). The campaign has circulated for months and appears effective against less-savvy users; the primary risk is identity theft and downstream misuse of collected PII. Recipients are advised to exercise caution with email links and attachments, regardless of how legitimate a site may appear.