InsureOTP Kit: Real-Time OTP Interception Phishing Campaign Targeting Insurance Providers (CTM360)

Key facts

Detection coverage

As of 2026-07-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1679 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Inbound Referrer to Insurer Portal From Rotating Free-Hosting Phishing Subdomain

Detects sessions arriving at the insurer's login/quote portal with an HTTP Referer or click-path originating from a disposable subdomain on GitHub Pages, Netlify, Hostinger, Wix, or Lovable — the free-hosting platforms the InsureOTP Kit abuses to serve brand-mimicking phishing pages that drive victims into the real-time OTP-relay chain (T1583.006, T1036.005, T1189).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1189, T1583.006, T1036.005
• Data sources: web_proxy, web_application_logs, iis_w3c_logs
• Severity: high
• Confidence: medium

Splunk SPL

index=web_proxy sourcetype="proxy:access" dest_url="*insurer-portal.example.com/login*"
| eval referer_domain=lower(coalesce(http_referer, referer))
| where match(referer_domain, "(\.github\.io|\.netlify\.app|\.hostinger\.[a-z]+|\.wixsite\.com|\.lovable\.app)")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips by referer_domain, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| table first_seen, last_seen, user, referer_domain, src_ips, count

Microsoft KQL

let freeHostSuffixes = dynamic(['.github.io', '.netlify.app', '.hostinger.', '.wixsite.com', '.lovable.app']);
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem has "/login" and csHost has "insurer-portal"
| extend RefererLower = tolower(csReferer)
| where freeHostSuffixes has_any (RefererLower)
| project TimeGenerated, cIP, csUserName, RefererLower, csUriStem
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Sessions=count(), SourceIPs=make_set(cIP) by RefererLower, csUserName

Sigma

title: Referrer From Free-Hosting Phishing Subdomain to Insurer Portal Login
id: 8f2a1c4e-1679-4a90-9c2b-insureotp01
status: experimental
description: Detects inbound traffic to the legitimate insurer login/API endpoint with an HTTP Referer consistent with rotating disposable subdomains on GitHub Pages, Netlify, Hostinger, Wix, or Lovable free-hosting platforms, as used by the InsureOTP Kit phishing framework.
references:
    - https://www.ctm360.com/reports/insuretrap-fake-insurance-phishing-account-hijacking
    - https://thehackernews.com/2026/07/ctm360-research-reveals-how-insurance.html
author: Threadlinqs Team
date: 2026-07-25
tags:
    - attack.initial-access
    - attack.t1189
    - attack.resource-development
    - attack.t1583.006
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: webserver
    product: web_application
detection:
    selection:
        cs-uri-stem|contains: '/login'
        cs(Referer)|contains:
            - '.github.io'
            - '.netlify.app'
            - '.hostinger'
            - '.wixsite.com'
            - '.lovable.app'
    filter:
        cs(Referer)|contains: 'internal-known-good-domain.example'
    condition: selection and not filter
falsepositives:
    - Legitimate marketing pages hosted on the same free-hosting platforms
    - Internal QA/staging traffic proxied through a free-hosting sandbox
level: medium

Known false positives:

• Legitimate insurer marketing/affiliate pages also hosted on GitHub Pages, Netlify, Hostinger, Wix, or Lovable
• Internal staging/QA environments proxied through a free-hosting sandbox domain

Tuning notes: Maintain an explicit allowlist of the insurer's own legitimate free-hosting-platform assets (marketing microsites, affiliate landing pages) to suppress known-good referrers; tighten by correlating with subsequent login_success events from the same session within a short window.

• 🔒 Malicious-Link Click-Through to Disposable Free-Hosting Phishing Subdomain · unlock with TL Creds
• 🔒 Concurrent Duplicate Sessions for a Single Customer Account From Distinct Source IPs · unlock with TL Creds
• 🔒 Sub-Second OTP Issuance-to-Submission Latency Consistent With Live Relay · unlock with TL Creds
• 🔒 Brand-Mimicking Manifest / Page-Title Artifact Referencing Insurer Brand on Non-Owned Infrastructure · unlock with TL Creds
• 🔒 Repeated Disposable Subdomain Registration on the Same Free-Hosting Provider (Domain-Rotation Pattern) · unlock with TL Creds
• 🔒 Automated Bulk Extraction Pattern From Web-Portal Capture Store (SQLite Operational Backend) · unlock with TL Creds
• 🔒 Rapid Login-to-Sensitive-Action Sequence Consistent With Real-Time OTP-Relay Account Takeover · unlock with TL Creds
• 🔒 Outbound Webhook Exfiltration to Telegram Bot API From Web-Facing Host · unlock with TL Creds

Indicators of compromise

As of 2026-07-25, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-1679.

Technical analysis

CTM360's report 'The InsureTrap: Real-Time Phishing & Account Hijacking Through Fake Insurance Portals' (published 2026-07-22, covered by The Hacker News 2026-07-25) documents a coordinated phishing operation targeting customers of multiple insurance providers, primarily in Saudi Arabia with secondary activity observed in Europe, the United States, and India.

The campaign is driven by sponsored Google Ads for common insurance search terms (e.g. 'Compare car insurance offers', 'Cheapest third-party insurance') that redirect victims to convincing, brand-mimicking phishing portals covering motor, health, life, home, and travel insurance lines. Rather than passively harvesting static credentials, the InsureOTP Kit operates as a real-time, human-in-the-loop attack framework: as a victim submits their login details on the fake portal, an operator (or automated relay) simultaneously uses the same data to authenticate against the legitimate insurer portal. When the real portal responds with a one-time password (OTP) or additional verification challenge, the phishing page dynamically prompts the victim for that exact code, captures it, and relays it back to the legitimate session before the OTP expires — achieving live account takeover and bypassing OTP/MFA controls entirely rather than merely stealing reusable secrets.

Backend architecture supporting the kit includes Telegram Bot API integrations that push structured victim submissions to operators for real-time review/approval, local (SQLite-based) storage of operational and victim records, and built-in administrative dashboards giving operators visibility into live sessions and manual approval workflows for OTP relay. Front-end phishing pages are not hosted on dedicated bulletproof infrastructure but instead on legitimate free/low-cost web-hosting and site-builder platforms — GitHub Pages, Netlify, Hostinger, Wix, and Lovable — using randomized, disposable subdomains that are rotated frequently to evade takedown and reputation-based blocking, and abusing the inherent trust and TLS validity of these mainstream platforms.

CTM360 categorizes this as part of a broader pattern of 'TrapPhishing'-style real-time interactive campaigns the vendor has tracked across sectors (e.g. corporate banking 'Cyberheist Phish', government portals 'GovTrap'), where attacker tooling is purpose-built to defeat OTP/MFA rather than rely on static phishing. No CVE or software vulnerability underlies this threat — it is a social-engineering and phishing-kit-driven campaign against the insurance vertical.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading

Credential Access

T1056 Input Capture; T1111 Multi-Factor Authentication Interception; T1557 Adversary-in-the-Middle

Collection

T1056 Input Capture; T1119 Automated Collection

Command and Control

T1071 Application Layer Protocol; T1102 Web Service

Initial Access

T1189 Drive-by Compromise

Execution

T1204 User Execution

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities

Reconnaissance

T1593 Search Open Websites/Domains

Impact

T1657 Financial Theft

stealth

T1684.001 Impersonation

Remediation

Immediate actions

• Alert insurance customers to verify insurer URLs directly (not via sponsored search ads) before entering credentials or OTPs
• Report and request takedown of phishing pages hosted on GitHub Pages, Netlify, Hostinger, Wix, and Lovable subdomains impersonating the insurer brand
• Monitor Google Ads brand-abuse channels and file trademark/malicious-ad complaints against sponsored listings impersonating the insurer
• Force session invalidation and password/OTP reset for any customer account with suspicious concurrent-session or rapid re-authentication activity
• Add fraud-detection rules for logins immediately followed by high-value policy or payment-method changes

Workarounds

• Disable SMS/email OTP as the sole MFA factor for high-value account actions (policy changes, payouts, payment method updates) pending phishing-resistant MFA rollout
• Add out-of-band verification (e.g. app push confirmation with transaction detail, not a bare numeric code) for sensitive account changes

Longer-term hardening

• Migrate OTP-based verification to phishing-resistant MFA (FIDO2/WebAuthn hardware keys or platform passkeys) that cannot be relayed by an attacker-in-the-middle
• Implement device fingerprinting and behavioral biometrics on the customer portal login flow to detect anomalous relay-style authentication patterns
• Deploy continuous brand-abuse / phishing-domain monitoring across free-hosting platforms (GitHub Pages, Netlify, Wix, Hostinger, Lovable) for the insurer's brand terms
• Establish a rapid takedown SLA and legal process with hosting providers and Google Ads abuse teams for insurance-brand impersonation

Affected and fixed versions

• Multiple Insurance Providers — Customer-facing insurance web portals (motor, health, life, home, travel lines)
  Vulnerable versions: Any OTP/SMS-based customer authentication flow
  Fixed in: Phishing-resistant MFA (FIDO2/WebAuthn) deployments not relayable via real-time interception
• Google — Google Ads (sponsored search)
  Vulnerable versions: Ad platform lacking brand-impersonation detection for insurance-comparison keywords
  Fixed in: N/A - policy/detection improvement, not a version

Timeline

• 2026-07-22 CTM360 publishes the full report 'The InsureTrap: Real-Time Phishing & Account Hijacking Through Fake Insurance Portals'.
• 2026-07-22 CTM360 confirms primary targeting of Saudi Arabia with secondary activity observed in Europe, the United States, and India.
• 2026-07-22 CTM360 documents the kit's Telegram Bot API integration, SQLite-based local storage, and admin dashboard supporting live manual OTP-relay approval by operators.
• 2026-07-22 CTM360 documents attacker abuse of GitHub Pages, Netlify, Hostinger, Wix, and Lovable for hosting rotating, disposable phishing subdomains.
• 2026-07-22 CTM360 maps 'The InsureTrap' campaign infrastructure, finding phishing pages impersonating motor, health, life, home, and travel insurance providers.
• 2026-07-22 CTM360 identifies and names the previously undocumented 'InsureOTP Kit', a purpose-built real-time OTP interception framework targeting insurance customers.
• 2026-07-25 TL-Intel Harness ingests and tracks the disclosure as an active, ongoing phishing threat (TL-2026-1679).
• 2026-07-25 The Hacker News covers CTM360's findings, bringing the InsureOTP Kit campaign to broader public and defender attention.

Sources cited

• The InsureTrap: Real-Time Phishing & Account Hijacking Through Fake Insurance Portals ctm360.com · Vendor report · 2026-07-22
• Cybersecurity Reports & Threat Intelligence Insights | CTM360 ctm360.com · Vendor report · 2026-07-22
• CTM360 maps out real-time phishing infrastructure targeting corporate banking worldwide Help Net Security · Research · 2025-05-19
• CTM360 Exposes Global GovTrap Campaign With 11,000+ Fake Government Portals Targeting Citizens Worldwide The Hacker News · Research · 2026-04-01
• CTM360 Identifies Surge in Phishing Attacks Targeting Meta Business Users The Hacker News · Research · 2025-05-01
• CTM360 Research Reveals How Insurance Customers Are Targeted by Real-Time OTP Phishing The Hacker News · News · 2026-07-25

More in phishing

• Microsoft Teams Booking-Flow Device Code Phishing Campaign Targeting Microsoft 365 Accounts
• Microsoft Teams Booking-Flow Lure Used for Device Code Phishing Against Construction Sector
• AWS Login Phishing: Abuse of `aws login --remote` Cross-Device Authentication Flow (Mitiga PoC)
• Tax-Season Phishing and Malware Campaigns Impersonating India's Income Tax Department Targeting Indian Taxpayers (ITD.zip / ITD_Tax_Notice.exe)
• Lookalike Microsoft Teams domains delivered via search ads, AI search answers and SEO poisoning (no phishing email)

Previous and next in phishing

• Call of Duty Mobile 'Free Points' Phishing Scam Uses Real-Time Credential Relay to Hijack Activision Accounts Previous report
• ShinyHunters-Impersonation Sextortion Scam Abuses Emails From 8 Prior Data Leaks, Demands $2,000 Next report