That MyChart Test Results Email Could Install Malware

An email arrives with the MyChart logo. Your recent results are ready. There is a button to sign in. If you use a patient portal, you have received that exact message before, for real. That is the problem, and it is exactly what makes this MyChart scam so effective.

As of August 27, 2026, 41 health systems across the United States had warned their patients about phishing emails using the MyChart name and logo, according to Healthcare Dive. Epic, the company behind MyChart, has published examples from its own security investigations so patients can recognize them.

One thing is worth saying right away, because it stops needless worry. MyChart itself has not been breached. Trevor Berceau, Epic's vice president of research and development, said the increase is due to scammers taking advantage of the popularity of the MyChart brand rather than any security concern. Your real portal is safe to keep using. I am Nitesh Kumar Gupta, founder and editor of The Scam Exposed, and in this guide I explain exactly how the scam works and how to stay safe without giving up a tool that helps your care.

In this article (15)

1. How widespread this is
2. What happens when you click
3. The step that installs malware
4. The free Medicare kit campaign
5. Why health messages work so well
6. A typical case
7. Red flags
8. Real vs fake MyChart email
9. The one habit that defeats it
10. How to protect yourself
11. If you already clicked
12. What to tell an older relative
13. Quick quiz
14. FAQ
15. How we researched this article

How widespread this is

This is not one hospital's problem. Reporting by Healthcare Dive found that as of late August 2026, 41 health systems across the country had sent warnings to their own patients. The American Hospital Association also published a notice that MyChart was warning about phishing schemes using fraudulent emails and other messages. MyChart itself has a dedicated page on staying safe from scams and fraud, with screenshots taken from Epic's security investigations.

What happens when you click

Epic has documented the sequence, and each step is designed to make the next one feel reasonable.

Step 1: The email

MyChart branding, a message that results are ready, and a sign in button. Nothing unusual, because real portals send this kind of email all the time.

Step 2: The fake login page

It looks exactly right, because the scammers copied the code from the real MyChart site. The address is something like mychart-epic.com, which is not MyChart.

Step 3: Your email, then your password

These are asked for on separate screens, exactly as the real portal does it. That small detail makes it feel more genuine, not less.

Step 4: A fake medical record

After you sign in, the site shows what looks like your chart, with a message saying an AI powered review found critical patterns in your blood work needing immediate attention. Every figure in that fake chart is invented. It exists to frighten you into the next step.

Step 5: The verification step

To see the full results, you are told to complete a human verification check. This is where the real damage happens.

The step that installs malware

This part is new, and worth recognizing by sight because it appears in other scams too, including fake CAPTCHA pages and fake tech support sites.

The page tells you to press the Windows key and R together, paste a command, and press Enter. It is presented as a routine human verification check, the kind of box ticking everyone is used to. But Windows + R opens the Run box, which executes commands directly on your computer. Pasting something there runs it. Epic says this installs malware.

An August variation dropped the command and offered a download called Full_Analysis_Report.exe instead, with instructions to click past the Windows security warning that appears.

Two rules, and neither has an exception:

• No website ever needs you to press Windows + R. Not one, for any reason.
• A security warning from Windows is the warning. Instructions telling you to bypass it are telling you what the file is.

On a Mac, the same trick may ask you to open Terminal and paste a command. The rule is the same: no real website asks you to do that.

The second campaign: the free Medicare kit

The same operation runs a second email, and this one targets money rather than your computer. It congratulates you on receiving an exclusive benefit, a free 2026 Medicare Health Kit. Sometimes it arrives as a delivery notice for a kit already on its way.

The link passes through unrelated advertising sites, then opens a MyChart branded survey with a countdown clock and a claim that only a few kits remain. After the survey, the kit is free but there is a small shipping charge. The checkout form collects your name, address, phone number, email and full card details.

No kit arrives. According to MyChart, the small first charge may be followed by further unauthorized charges.

Epic's guidance puts the test plainly. MyChart is a place for your medical records. It does not hold giveaways. An email in which MyChart is giving you a product is fake. One more detail from the warning is useful: the small print signs off as MyChart Health Network at an address in Verona, Wisconsin. No such company exists and the address is wrong.

Why health messages work better than bank ones

Most people have learned to pause over a message about money. Very few pause over a message about their health.

An email saying your test results are ready produces a different reaction. If you are waiting on bloodwork, a biopsy or a scan, the urge to look is immediate and overrides caution. The fake chart then escalates that with a warning about critical patterns needing attention. Fear does the work. By the time the Run command appears, you are not evaluating a website. You are trying to find out whether something is wrong with you.

There is another reason health messages work. Patient portals are relatively new for many older adults, who may have been signed up by a clinic and only log in a few times a year. They do not know exactly what a real MyChart email or login page looks like, so they have no baseline to compare against.

A typical case

The following is a typical case built from the pattern Epic described. It is not a specific real person.

A 68 year old man had blood drawn at his annual checkup and is waiting for the results. Two days later an email arrives with the MyChart logo saying his results are ready. He clicks the button, types his email on the first screen and his password on the second, exactly as he remembers doing before. A chart appears with numbers in red and a warning that an AI review found critical patterns needing urgent attention.

His heart races. To see the full report, the page asks him to verify he is human by pressing Windows and R, pasting a line of text, and pressing Enter. He does it. Nothing seems to happen, and the page says the report will be emailed shortly.

The next day his real MyChart app shows normal results from his doctor. He realizes something was wrong and calls his grandson. By then, the malware had already captured saved browser passwords on his computer, and his email account was signed in from another country. They spend the evening changing passwords from his phone, running a security scan, and calling his bank to watch for unusual activity.

Red flags

• The email does not name your health system. Real MyChart emails come from your own provider or MyChart Central and show that organization's name.
• The address after the page loads is not your health system's. Anything like mychart-epic.com is not MyChart.
• It refers to a provider you have never used. If you have no account there, no results can be waiting.
• The chart shows alarming results with urgent warnings. Real results are released by your care team, often with a note from your doctor.
• It asks you to press Windows + R or open Terminal. No real website ever does this.
• It asks you to bypass a security warning. The warning is right.
• It offers a free gift or Medicare kit. MyChart does not hold giveaways.
• There is a countdown clock. Medical records do not expire in fifteen minutes.

Real vs fake MyChart email

The one habit that defeats all of it

Never reach your patient portal through a link in a message. Open the app on your phone, type your health system's own web address yourself, or use a bookmark you saved. Then sign in and look. If results are waiting, they will be there.

That single habit works against every version of this MyChart scam, including ones that have not appeared yet, because you are not judging whether an email is real. You are refusing to use the route it offers. It is the same rule we recommend for banks and insurers in our guide to spotting fake bank, Amazon and IRS emails.

Why the paste a command trick is spreading

The Windows + R step in this MyChart scam is part of a wider trend. Security teams sometimes call it a paste and run lure. Instead of trying to sneak malware past your antivirus with an attachment, the criminal simply asks you to run it yourself. Because you are the one pressing the keys, many protections treat it as something you meant to do.

The lure is always dressed up as something harmless and familiar. It might be a CAPTCHA that says to prove you are human, a fix for a broken video player, a document viewer that needs an update, or in this case a check before you can see your medical results. The instructions are short and sound technical enough to feel official: press this key, then this one, paste, press Enter.

What actually gets pasted is a command that quietly downloads and runs a program in the background. Common results include password stealers that copy logins saved in your browser, remote access tools that let a criminal control your computer, and programs that watch for banking sites. You usually see nothing happen on screen, which is why people do not realize anything is wrong.

The good news is that this trick has one fixed weakness. It cannot work without you. If you hold to the rule that you never paste anything into Run, Terminal or PowerShell because a website told you to, every version of it fails, whatever brand it borrows next.

The same scam by text and phone

Email is the main channel for this campaign, but the same fear can arrive by text message, or by a phone call from someone claiming to be from your clinic's billing office or a lab. The rule does not change. A real health system can always be reached by calling the number on your appointment card, your bill, or its official website. If someone contacts you first and pushes you to click, pay or install something today, hang up and call back on a number you found yourself.

How to protect yourself

1. Install your health system's MyChart app and use it as your only way into the portal.
2. Bookmark your health system's portal on your computer for when you need a bigger screen.
3. Turn on two step login where your health system offers it.
4. Use a unique password for MyChart and a different one for your email.
5. Keep Windows or macOS and your security software updated, so known malware is blocked.
6. Never paste anything into Run, Terminal or PowerShell because a website told you to.
7. Ask your doctor's office how they share results, so you know what to expect and when.
8. Forward suspicious MyChart emails to your health system's privacy or IT team, using the address on their official site.

Hospital themed scams overlap with other health privacy issues too. Our guide to telehealth privacy for seniors covers what to check before signing up for online care, and our report on phishing pages hosted on trusted cloud services explains why a link can look safe and still be fake. For scam texts that use the same fear tactics, see the 5 scam texts to know in 2026.

If you already entered your details or ran the command

If you entered your login

1. Change your MyChart password now from the real app or real site, and anywhere else you used the same password.
2. Change your email password too. Email is the reset route for every other account you own.
3. Turn on two step login where offered.
4. Tell your health system. Their privacy or IT team can check your record for unauthorized access.

If you ran the command or downloaded the file

1. Disconnect from the internet. Unplug the cable or switch off Wi-Fi.
2. Change your passwords from a different device, not the affected one.
3. Run a full scan with Windows Defender or your security software, or take the machine to a technician you found yourself, not one from a pop up.
4. Watch bank and card statements for small unfamiliar charges, which is how stolen cards get tested.

If you paid for a Medicare kit or lost money

1. Call your bank or card issuer right now using the number on the back of your card. Ask them to block the card, stop or reverse any pending payment, and flag the account for fraud. Speed matters more than anything else.
2. If you gave your Medicare number, call 1-800-MEDICARE and tell them it may be compromised, then report it to the Senior Medicare Patrol at 1-877-808-2468. Watch your Medicare statements for services you never received.
3. Report it to the FTC at ReportFraud.ftc.gov. Your report goes into the Consumer Sentinel database used by law enforcement across the country.
4. Report it to the FBI at IC3.gov, especially if money was taken. Include dates, amounts, phone numbers, links and screenshots.
5. If personal details were exposed, create a recovery plan at IdentityTheft.gov and consider a free credit freeze with Equifax, Experian and TransUnion.
6. If you are 60 or older, or helping someone who is, call the National Elder Fraud Hotline free at 1-833-372-8311. A case manager can walk you through every report.
7. Keep a written log of every call, text, website and payment. Banks and investigators move faster when the facts are in one place.

Our page on the first 48 hours after a scam covers the bank conversation and dispute deadlines in detail.

What to tell an older relative

Keep it to one sentence, because that is what survives a frightening email: open the app, never the link.

Then add the part that changes behavior. Tell them that if a message says something urgent about their health, they should call you or their doctor's office rather than clicking anything, and that no real result will disappear while they check. Show them the MyChart app on their phone and practice opening it together once, so the safe route is the familiar one.

Quick quiz: scam or not?

An email with the MyChart logo says your results are ready but does not mention your clinic's name. Scam or not?

Treat it as a scam. Real MyChart emails name your health system. Open the app yourself to check instead.

After logging in, a page says to press Windows + R and paste a code to prove you are human. Scam or not?

Scam. No real website ever asks for this. It runs a command that installs malware.

You open the MyChart app on your phone and see a new message from your doctor about your lab results. Scam or not?

Not a scam. You reached the app yourself, which is the safe route. Read it there.

Frequently asked questions

Help us warn others

Got this call or message? Search the number on The Scam Exposed and leave a comment on its page to warn others. Every comment helps the next person who looks that number up before calling back.

Share this with a parent or grandparent. A two minute read today can save a family thousands of dollars tomorrow. Scammers count on people not talking about this, so talking about it is one of the best defenses we have.

How we researched this article

This article is based on MyChart's guidance on staying safe from scams and fraud, with examples from Epic security investigations, the American Hospital Association notice of August 2026, reporting by Healthcare Dive on health systems warning patients, and the FTC's advice on how to recognize and avoid phishing scams. The typical case is a composite of the reported pattern, not a specific person.

This article is for general information and awareness only and is not medical, legal or financial advice. For questions about your own records or results, contact your health system directly using contact details you already trust.