CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking
Summary: CTM360's investigation found insurance-focused phishing campaigns that authenticate against legitimate insurer portals in real time as victims complete login, relaying one-time passwords before they expire so the attack finishes inside a single browsing session. The operation reused one infrastructure across multiple insurance brands, delivered traffic through sponsored Google ads for insurance quotes and renewals, hosted pages on services including GitHub Pages, Netlify, Hostinger, Wix and Lovable, and was run by a previously undocumented kit CTM360 named InsureOTP Kit, with Saudi Arabia the primary target and activity also seen in Europe, the United States and India.
Bottom line: The gap between credential theft and account abuse has collapsed to the length of one login session, so incident response that assumes time to react no longer applies. Compromised insurance accounts hold identity documents, policy records and payment methods, which extends the damage well past the initial breach.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026