Insurance phishing kits now relay your OTP live instead of just stealing your password

CTM360 published research on July 25, 2026 describing a coordinated phishing campaign against insurance providers, concentrated on Saudi Arabia with additional activity in Europe, the US, and India. The operation has moved past static credential harvesting into what the researchers call session-time compromise: as a victim submits their password on a fake portal, the attacker's infrastructure logs into the real insurance site simultaneously, an adversary-in-the-middle technique. When the legitimate portal sends a one-time passcode, the phishing page prompts the victim to enter it "as routine identity verification," then relays that code to the real site before it expires, completing authentication while the victim never realizes anything was wrong. The campaign drove traffic through Google Ads targeting insurance-quote searches, hosted on disposable platforms including GitHub Pages, Netlify, and Wix, and ran on a previously undocumented phishing-as-a-service kit CTM360 named InsureOTP, complete with live session dashboards and Telegram bot integration.

Why it matters

This is the same adversary-in-the-middle mechanics as the Kratos phishing kit covered earlier, applied to a sector, insurance, that doesn't usually top the phishing-target list. Phishing-resistant MFA methods that bind the credential to the origin defeat this by design; a one-time code entered on any page, real or fake, does not.

The detail worth flagging to users specifically: framing the OTP prompt as "routine identity verification" is the social-engineering hook that makes people comply. Any login flow that asks for a code without the user having initiated the login themselves deserves suspicion, insurance portal or otherwise.

Source: The Hacker News