Insurance phishing kits now relay your OTP live instead of just stealing your password
CTM360 found a phishing operation, centered on Saudi Arabia with activity across Europe, the US, and India, using a kit called InsureOTP that authenticates against real insurance portals in real time and relays victims' one-time passcodes before they expire.
CTM360 published research on July 25, 2026 describing a coordinated phishing campaign against insurance providers, concentrated on Saudi Arabia with additional activity in Europe, the US, and India. The operation has moved past static credential harvesting into what the researchers call session-time compromise: as a victim submits their password on a fake portal, the attacker's infrastructure logs into the real insurance site simultaneously, an adversary-in-the-middle technique. When the legitimate portal sends a one-time passcode, the phishing page prompts the victim to enter it "as routine identity verification," then relays that code to the real site before it expires, completing authentication while the victim never realizes anything was wrong. The campaign drove traffic through Google Ads targeting insurance-quote searches, hosted on disposable platforms including GitHub Pages, Netlify, and Wix, and ran on a previously undocumented phishing-as-a-service kit CTM360 named InsureOTP, complete with live session dashboards and Telegram bot integration.
Why it matters
This is the same adversary-in-the-middle mechanics as the Kratos phishing kit covered earlier, applied to a sector, insurance, that doesn't usually top the phishing-target list. Phishing-resistant MFA methods that bind the credential to the origin defeat this by design; a one-time code entered on any page, real or fake, does not.
The detail worth flagging to users specifically: framing the OTP prompt as "routine identity verification" is the social-engineering hook that makes people comply. Any login flow that asks for a code without the user having initiated the login themselves deserves suspicion, insurance portal or otherwise.
Source: The Hacker News
Related on Start with Identity
- BlogDevice code phishing industrialises: 25 kits, and Microsoft counts new campaigns daily
The OAuth device authorization flow built for smart TVs is now a phishing-as-a-service product line. Microsoft reported 10 to 15 new campaigns every 24 hours by
- BlogRecruitTrap ran 3,000 fake recruitment logins with browser-in-the-browser popups and live MFA relay
CTM360 found over 3,000 phishing URLs impersonating recruiters at 50-plus organizations across 14 sectors. The pages fake a browser window, complete with addres
- BlogJalisco and OmegaLord: phishing kits built around device-code abuse
ReliaQuest found two Microsoft 365 phishing kits. Jalisco abuses the OAuth device authorization grant, generating fresh codes in real time to beat the 15-minute
- TechniqueOTP relay via social engineering
The attacker starts a real login and calls the victim posing as support, asking them to read back the one-time code that just arrived. The code is genuine; the
- TechniqueAttacker-in-the-middle phishing proxy
A reverse proxy sits between the user and the real login page, relays every step of authentication including MFA, and keeps the session cookie the successful lo
- RankingBest Password Managers for Business: Top 5
The best business password managers in 2026: Bitwarden, Keeper, Dashlane, NordPass, and Zoho Vault. Ranked for team sharing, admin controls, SSO, and value.