# InsureOTP Kit: Real-Time OTP Interception Phishing Campaign Targeting Insurance Providers (CTM360)

> CTM360 disclosed 'The InsureTrap' — a coordinated real-time phishing campaign using a previously undocumented phishing framework, the 'InsureOTP Kit', to impersonate motor, health, life, home and travel insurance providers. Victims lured via sponsored Google Ads land on fake insurer portals that harvest credentials and relay live one-time passwords to the legitimate service before they expire, enabling authenticated account hijacking rather than static credential theft.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1679
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-insuretrap-insurance-otp-relay-tl-2026-1679.webp?v=0eee5a75 (Threadlinqs threat intel: InsureOTP Kit Real-Time OTP Relay: Detection & IOCs (TL-2026-1679) — High severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-1679
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15

## Description

CTM360's report 'The InsureTrap: Real-Time Phishing & Account Hijacking Through Fake Insurance Portals' (published 2026-07-22, covered by The Hacker News 2026-07-25) documents a coordinated phishing operation targeting customers of multiple insurance providers, primarily in Saudi Arabia with secondary activity observed in Europe, the United States, and India.

The campaign is driven by sponsored Google Ads for common insurance search terms (e.g. 'Compare car insurance offers', 'Cheapest third-party insurance') that redirect victims to convincing, brand-mimicking phishing portals covering motor, health, life, home, and travel insurance lines. Rather than passively harvesting static credentials, the InsureOTP Kit operates as a real-time, human-in-the-loop attack framework: as a victim submits their login details on the fake portal, an operator (or automated relay) simultaneously uses the same data to authenticate against the legitimate insurer portal. When the real portal responds with a one-time password (OTP) or additional verification challenge, the phishing page dynamically prompts the victim for that exact code, captures it, and relays it back to the legitimate session before the OTP expires — achieving live account takeover and bypassing OTP/MFA controls entirely rather than merely stealing reusable secrets.

Backend architecture supporting the kit includes Telegram Bot API integrations that push structured victim submissions to operators for real-time review/approval, local (SQLite-based) storage of operational and victim records, and built-in administrative dashboards giving operators visibility into live sessions and manual approval workflows for OTP relay. Front-end phishing pages are not hosted on dedicated bulletproof infrastructure but instead on legitimate free/low-cost web-hosting and site-builder platforms — GitHub Pages, Netlify, Hostinger, Wix, and Lovable — using randomized, disposable subdomains that are rotated frequently to evade takedown and reputation-based blocking, and abusing the inherent trust and TLS validity of these mainstream platforms.

CTM360 categorizes this as part of a broader pattern of 'TrapPhishing'-style real-time interactive campaigns the vendor has tracked across sectors (e.g. corporate banking 'Cyberheist Phish', government portals 'GovTrap'), where attacker tooling is purpose-built to defeat OTP/MFA rather than rely on static phishing. No CVE or software vulnerability underlies this threat — it is a social-engineering and phishing-kit-driven campaign against the insurance vertical.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1036 Masquerading
- T1684.001 Impersonation
- T1557 Adversary-in-the-Middle
- T1111 Multi-Factor Authentication Interception
- T1056 Input Capture
- T1056 Input Capture
- T1119 Automated Collection
- T1102 Web Service
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Inbound Referrer to Insurer Portal From Rotating Free-Hosting Phishing Subdomain** (`TL-2026-1679-SPL-001`)

Detects sessions arriving at the insurer's login/quote portal with an HTTP Referer or click-path originating from a disposable subdomain on GitHub Pages, Netlify, Hostinger, Wix, or Lovable — the free-hosting platforms the InsureOTP Kit abuses to serve brand-mimicking phishing pages that drive victims into the real-time OTP-relay chain (T1583.006, T1036.005, T1189).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1189, T1583.006, T1036.005
- **Data sources:** web_proxy, web_application_logs, iis_w3c_logs
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=web_proxy sourcetype="proxy:access" dest_url="*insurer-portal.example.com/login*"
| eval referer_domain=lower(coalesce(http_referer, referer))
| where match(referer_domain, "(\.github\.io|\.netlify\.app|\.hostinger\.[a-z]+|\.wixsite\.com|\.lovable\.app)")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips by referer_domain, user
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| table first_seen, last_seen, user, referer_domain, src_ips, count
```

### Microsoft KQL

```kql
let freeHostSuffixes = dynamic(['.github.io', '.netlify.app', '.hostinger.', '.wixsite.com', '.lovable.app']);
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem has "/login" and csHost has "insurer-portal"
| extend RefererLower = tolower(csReferer)
| where freeHostSuffixes has_any (RefererLower)
| project TimeGenerated, cIP, csUserName, RefererLower, csUriStem
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Sessions=count(), SourceIPs=make_set(cIP) by RefererLower, csUserName
```

### Sigma

```yaml
title: Referrer From Free-Hosting Phishing Subdomain to Insurer Portal Login
id: 8f2a1c4e-1679-4a90-9c2b-insureotp01
status: experimental
description: Detects inbound traffic to the legitimate insurer login/API endpoint with an HTTP Referer consistent with rotating disposable subdomains on GitHub Pages, Netlify, Hostinger, Wix, or Lovable free-hosting platforms, as used by the InsureOTP Kit phishing framework.
references:
    - https://www.ctm360.com/reports/insuretrap-fake-insurance-phishing-account-hijacking
    - https://thehackernews.com/2026/07/ctm360-research-reveals-how-insurance.html
author: Threadlinqs Team
date: 2026-07-25
tags:
    - attack.initial-access
    - attack.t1189
    - attack.resource-development
    - attack.t1583.006
    - attack.defense-evasion
    - attack.t1036.005
logsource:
    category: webserver
    product: web_application
detection:
    selection:
        cs-uri-stem|contains: '/login'
        cs(Referer)|contains:
            - '.github.io'
            - '.netlify.app'
            - '.hostinger'
            - '.wixsite.com'
            - '.lovable.app'
    filter:
        cs(Referer)|contains: 'internal-known-good-domain.example'
    condition: selection and not filter
falsepositives:
    - Legitimate marketing pages hosted on the same free-hosting platforms
    - Internal QA/staging traffic proxied through a free-hosting sandbox
level: medium
```

**Known false positives:**

- Legitimate insurer marketing/affiliate pages also hosted on GitHub Pages, Netlify, Hostinger, Wix, or Lovable
- Internal staging/QA environments proxied through a free-hosting sandbox domain

**Tuning notes:** Maintain an explicit allowlist of the insurer's own legitimate free-hosting-platform assets (marketing microsites, affiliate landing pages) to suppress known-good referrers; tighten by correlating with subsequent login_success events from the same session within a short window.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Malicious-Link Click-Through to Disposable Free-Hosting Phishing Subdomain (locked: unlock with TL Creds)
- Concurrent Duplicate Sessions for a Single Customer Account From Distinct Source IPs (locked: unlock with TL Creds)
- Sub-Second OTP Issuance-to-Submission Latency Consistent With Live Relay (locked: unlock with TL Creds)
- Brand-Mimicking Manifest / Page-Title Artifact Referencing Insurer Brand on Non-Owned Infrastructure (locked: unlock with TL Creds)
- Repeated Disposable Subdomain Registration on the Same Free-Hosting Provider (Domain-Rotation Pattern) (locked: unlock with TL Creds)
- Automated Bulk Extraction Pattern From Web-Portal Capture Store (SQLite Operational Backend) (locked: unlock with TL Creds)
- Rapid Login-to-Sensitive-Action Sequence Consistent With Real-Time OTP-Relay Account Takeover (locked: unlock with TL Creds)
- Outbound Webhook Exfiltration to Telegram Bot API From Web-Facing Host (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CTM360 Research Reveals How Insurance Customers Are Targeted by Real-Time OTP Phishing](https://thehackernews.com/2026/07/ctm360-research-reveals-how-insurance.html)
- [The InsureTrap: Real-Time Phishing & Account Hijacking Through Fake Insurance Portals](https://www.ctm360.com/reports/insuretrap-fake-insurance-phishing-account-hijacking)
- [Cybersecurity Reports & Threat Intelligence Insights | CTM360](https://www.ctm360.com/cybersecurity-reports)
- [CTM360 maps out real-time phishing infrastructure targeting corporate banking worldwide](https://www.helpnetsecurity.com/2025/05/19/ctm360-cyberheist-phish-report/)
- [CTM360 Exposes Global GovTrap Campaign With 11,000+ Fake Government Portals Targeting Citizens Worldwide](https://thehackernews.com/expert-insights/2026/04/ctm360-exposes-global-govtrap-campaign.html)
- [CTM360 Identifies Surge in Phishing Attacks Targeting Meta Business Users](https://thehackernews.com/2025/05/ctm360-identifies-surge-in-phishing.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1679