CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose. That model is changing. Recent investigations into insurance-focused phishing operations reveal a more immediate approach. Instead of harvesting

The article reports CTM360’s findings on an insurance-focused phishing kit (InsureOTP) that turns fake insurance portals into real-time man-in-the-middle channels, capturing credentials and one-time passwords and immediately hijacking accounts in the same session.[1][2] It describes live victim monitoring, backend interfaces that can request multiple OTPs, and synchronized interaction with legitimate insurance portals to defeat multi-factor authentication and establish authenticated sessions.[1][2] From a RealGround perspective, any AI-powered insurance or fintech portals, fraud-detection models, or customer-support agents exposed to these workflows could be abused as high-confidence signals for attackers or as automation targets, increasing account takeover risk and downstream financial fraud. Organizations should subject their AI-integrated authentication and session-handling flows to continuous red teaming to detect real-time OTP interception patterns, enforce stronger out-of-band verification, and harden AI-driven interfaces against being used as live intermediaries in account hijacking operations.