CTM360 Details InsureOTP Kit Used for Real-Time Insurance Account Hijacking
Summary
CTM360 reports that insurance phishing operators use sponsored Google ads and the InsureOTP Kit to relay credentials and OTPs to legitimate portals in real time, targeting providers across Saudi Arabia, Europe, the U.S. and India.
Key points
- CTM360 reports that attackers use sponsored Google ads to direct insurance seekers to phishing sites imitating providers across multiple regions.
- The phishing sites relay victims’ credentials and OTPs to legitimate portals during the same login session, enabling account access in real time.
- CTM360 identified the InsureOTP Kit, which it says supports session tracking, administrative dashboards, manual approvals, live OTP handling, and Telegram Bot integrations.
- Some observed kit variants sent submissions through Telegram Bot APIs; others communicated directly with attacker-controlled backends.
- CTM360 says analysis of exposed archives revealed backend source code, SQLite databases, administrative components, and operational records.
- The article recommends monitoring brand-abusing ads, lookalike domains, disposable hosting, and authentication activity indicative of real-time OTP interception.
Article Details
- Attack Vectors
- Sponsored Google ads lure users to insurance-themed phishing websites.
- Phishing portals imitate insurance providers and capture credentials and OTPs, relaying them in real time to legitimate insurance portals.
- The InsureOTP Kit supports live victim-session handling and sends submissions through Telegram Bot integrations or attacker-controlled backend servers.
- Defensive Notes
- Monitor for paid advertisements abusing organizational brands and newly registered lookalike domains.
- Monitor disposable cloud-hosted phishing infrastructure and authentication patterns that may indicate real-time OTP interception.
- Investigate campaign infrastructure and workflows rather than treating each phishing site as an isolated incident.
MITRE ATT&CK
T1056.003 · Web Portal CaptureImitation insurance portals capture victims’ account credentials and OTP submissions.T1078 · Valid AccountsOperators use captured credentials and relayed OTPs to authenticate to legitimate insurance portals.T1111 · Multi-Factor Authentication InterceptionOperators relay victims’ OTPs to legitimate insurance portals during the same session.T1204.001 · Malicious LinkVictims click sponsored advertisements that lead to insurance-themed phishing websites.
Products
Tools
Countries
IndiaThe campaign targets multiple insurance brands across Saudi Arabia, Europe, the United States, and India.Saudi ArabiaThe campaign targets multiple insurance brands across Saudi Arabia, Europe, the United States, and India.United StatesThe campaign targets multiple insurance brands across Saudi Arabia, Europe, the United States, and India.