Insurance Phishing Goes Real-Time: Inside the InsureOTP Kit
CTM360 has uncovered a phishing framework that no longer waits to cash in stolen logins — it hijacks insurance accounts live, relaying intercepted OTPs before they expire.
Key Takeaways
- CTM360 identified the **InsureOTP Kit**, a previously undocumented phishing framework built to hijack insurance accounts in real time rather than harvest credentials for later reuse.
- The kit relays intercepted one-time passwords to the legitimate portal before they expire, collapsing the usual delay between credential theft and account takeover into a single live session.
- Campaigns concentrate on Saudi Arabia's insurance sector, with additional activity across Europe, the US and India, delivered largely through sponsored Google Ads.
- Operators host disposable phishing domains on legitimate platforms — GitHub Pages, Netlify, Hostinger, Wix, Lovable — to blend into normal traffic and frustrate takedowns.
For years, phishing against financial and insurance targets followed a predictable pattern: steal a username and password, bank the credentials, and come back to abuse the account when it's convenient. New research from CTM360 shows that model breaking down in the insurance sector, where attackers now synchronise their activity with the victim's own login session and take the account over before the page even finishes loading.
From harvest-and-wait to live session hijacking
The attack CTM360 documents runs as a single continuous workflow rather than discrete stages. A victim enters credentials on a lookalike insurance portal; the attacker immediately replays those credentials against the real provider. When the legitimate site responds with a one-time password request, the phishing page prompts the victim to enter it under the guise of "routine verification." That OTP is then relayed to the real portal before it expires — completing authentication while the victim believes they are simply logging in.
The InsureOTP Kit
CTM360 attributes much of this activity to what it calls the InsureOTP Kit — a purpose-built, previously undocumented framework rather than a one-off script. It gives operators a backend administrative dashboard, live session tracking, and manual-approval workflows, so an operator can watch a victim's session unfold and intervene as needed. If an OTP submission fails or authentication is rejected, the backend can request another code from the victim before the window closes. Victim data flows to attackers either through direct backend API calls or through Telegram bot integrations, letting non-technical operators run the fraud loop from a phone.
Malvertising and trusted hosting as cover
Distribution leans on sponsored Google Ads surfaced against searches for insurance quotes, renewals, or price comparisons — putting the fake portal ahead of the real one in the results a victim actually clicks. The sites themselves closely clone the branding, quotation workflows, and customer-portal layout of real insurers. To stay ahead of blocklists, operators host these pages on legitimate platforms — GitHub Pages, Netlify, Hostinger, Wix, and Lovable among them — behind randomised, disposable domains that get discarded and replaced as soon as they're flagged. CTM360's research centres on Saudi Arabia's insurance market, with additional activity observed across Europe, the United States, and India.
Why this matters beyond one sector
The mechanics here — adversary-in-the-middle credential relay plus live OTP interception — aren't specific to insurance; they defeat any login flow that relies on SMS or app-generated one-time codes as its only second factor. Insurance accounts are a rational target precisely because they sit on identity documents, policy and payment details, and claims history that support fraud well beyond the initial login. Security teams evaluating their own exposure should treat this as a reminder that time-limited OTPs, without a phishing-resistant binding to the session, are not a durable control against a sufficiently automated relay.
- Move high-value customer and employee portals toward phishing-resistant authentication (FIDO2/WebAuthn passkeys) rather than SMS or app-generated OTP alone.
- Monitor for typosquat domains and cloned portal branding on the free hosting platforms named in this report, not just classic bulletproof hosting.
- Treat malvertising as a delivery channel worth monitoring — brand-protection coverage that ignores paid search results misses this vector entirely.
- Flag unusual OTP-retry patterns (repeated codes requested in quick succession for one account) as a detection signal, since it's a hallmark of live relay kits.
FAQ
Frequently Asked Questions
How is this different from ordinary credential phishing?
Ordinary phishing harvests a username and password to be used or sold later. The InsureOTP Kit relays stolen credentials and OTPs to the real portal within the same session, so the account takeover happens while the victim is still on the phishing page, not days or weeks afterward.
Does SMS or app-based one-time-password MFA still protect against this?
Not reliably. Because the kit relays the victim's own OTP to the legitimate site before it expires, a standard time-based OTP provides little protection. Phishing-resistant methods like FIDO2/WebAuthn passkeys, which bind authentication to the legitimate origin, are far harder for this kind of relay to defeat.
Why is the insurance sector a specific target here?
CTM360's research found the InsureOTP Kit concentrated on Saudi Arabia's insurance sector, with additional activity in Europe, the US, and India, delivered through malicious Google Ads targeting quote and renewal searches. Insurance accounts often hold identity documents and payment data that support fraud beyond the initial breach.