Insurance Phish Turns OTPs Into Live Account Hijacks

How the attack worked

This campaign begins not with an email or text message but with a sponsored search ad. Victims searching for insurance quotes or comparisons see ads promising offers like cheap car insurance, and clicking them leads to a polished lookalike insurance portal. The site asks for login credentials and then, framed as routine identity verification, prompts for a one-time passcode (OTP). Rather than storing that OTP for later use, the phishing page relays it to the real insurance provider's site in real time, completing the login before the code expires. Researchers at CTM360 identified a purpose-built framework behind this activity, named the InsureOTP Kit, which includes live session monitoring, admin dashboards, and the ability to request additional OTPs if an authentication attempt fails.

Why it succeeded

The attack collapses several stages that defenders typically expect to be separated by time. Credential harvesting, OTP interception, and account takeover all happen within a single browsing session, leaving little or no window between theft and abuse. The use of sponsored ads as the delivery mechanism also bypasses common phishing awareness training that focuses on suspicious emails or SMS messages. Because the attacker infrastructure is hosted on legitimate platforms like GitHub Pages, Netlify, Hostinger, and Wix, and rotates frequently, brand monitoring and static blocklists struggle to keep pace.

What to watch for

• A sponsored ad result appearing for a sensitive login or quote journey
• An unfamiliar or randomized domain that doesn't match the insurer's official site
• An unexpected OTP prompt on a site reached through an ad rather than a bookmarked or typed URL
• Repeated "verification failed, try again" prompts asking for a second OTP
• A highly polished portal hosted on generic or free site-builder infrastructure

How to build resistance

Organizations in insurance and financial services should treat OTPs as sensitive as passwords and train customers, call center staff, and fraud teams to never enter one on a page reached via an ad or unfamiliar link. Encouraging navigation to insurance and finance logins through official bookmarks or manually typed URLs reduces exposure to malicious ads. Because the entire attack chain can complete in a single session, incident response plans should assume account takeover can happen immediately rather than relying on a delay. Marketing and brand protection teams should also monitor for paid ads abusing the organization's brand and for lookalike portals hosted on common cloud and site-builder platforms, since these are the primary channels this kit relies on.

How does this insurance phishing attack start?

It typically starts with a sponsored Google ad promising cheap insurance quotes or comparisons, which redirects victims to a convincing lookalike insurance portal.

Why are OTPs not enough to stop this attack?

The phishing page acts as a live intermediary, capturing the OTP the victim enters and immediately relaying it to the real insurance site before it expires, completing account takeover during the same session.

What is the InsureOTP Kit?

CTM360 identified and named a previously undocumented phishing framework called InsureOTP Kit that supports live session monitoring, OTP handling, admin dashboards, and Telegram-based data exfiltration.

What infrastructure did attackers use to host these fake portals?

Attackers used disposable infrastructure built on legitimate hosting and site-builder tools such as GitHub Pages, Netlify, Hostinger, and Wix to rotate sites quickly and evade brand monitoring.