Insurance Phishing Evolves Into Real-Time Account Hijacking
CTM360 research reveals how insurance phishing operations have advanced.
1The Evolution of Insurance Phishing Operations
Traditional phishing campaigns aimed to collect user credentials for later use. However, recent research shows that insurance-focused phishing operations have adopted a more immediate approach. Attackers access legitimate insurance portals in real time as victims enter their credentials. This method allows the attack to be completed within a single browsing session.
2The Rise of Digital Insurance Services
Insurance providers have expanded their services to allow customers to purchase policies, renew coverage, submit claims, and make payments entirely through digital portals. While this improves customer experience, it also creates an attractive environment for threat actors. Sensitive data such as personal information, identity documents, and policy records have become valuable targets for attackers.
3Global Targets and Methods
CTM360's research revealed that Saudi Arabia was the primary target, with additional activity observed in Europe, the US, and India. Attackers reused the same operational infrastructure, adapting language and branding to local markets. This approach enabled campaigns to be effective across a broader geographic area.
4Distribution Through Google Ads
Instead of phishing emails or SMS campaigns, attackers used Google ads to target users. Offers such as 'Compare car insurance quotes' or 'Cheapest third-party insurance' redirected users to what appeared to be legitimate services. These ads proved to be an effective tool in directing victims to phishing sites.
5Realistic Phishing Sites
After clicking on ads, victims were redirected to phishing sites that closely mimicked legitimate insurance providers. These sites replicated branding, user interfaces, and workflows to reduce suspicion and facilitate the collection of credentials.
6Disposable Infrastructure and Hosting
Attackers used legitimate website builders and free hosting platforms such as GitHub Pages, Netlify, and Hostinger to support phishing campaigns. Randomly generated domains with no resemblance to insurance brands allowed campaigns to rotate rapidly, rendering brand monitoring efforts ineffective.
7Real-Time Authentication
Modern insurance phishing campaigns not only collect victim credentials but also use them in real time on legitimate insurance portals. One-time passwords (OTPs) entered by victims are immediately relayed to the legitimate portal, enabling attackers to complete the authentication process.
8InsureOTP Kit and Its Implications
CTM360 discovered a new phishing kit named InsureOTP Kit, specifically designed for insurance-themed phishing operations. The kit offers live session management, real-time data collection, and multiple data exfiltration methods. This advanced infrastructure allows attackers to actively manage each victim session, increasing the effectiveness of phishing operations.
Original article: The Hacker News — Sigorta Dolandırıcılığında Gerçek Zamanlı Hesap Ele Geçirme