CTM360 Research Details Real-Time Account Hijacking in Insurance Phishing Campaigns

Evolution of Phishing Tactics

CTM360's recent investigations into insurance-focused phishing operations reveal a new approach to account compromise. Historically, phishing involved collecting credentials for later use. Now, attackers synchronize their activity with victims in real time, authenticating against legitimate insurance portals as victims unknowingly complete the login process, allowing the entire attack to unfold within a single browsing session.

Why Insurance is a Target

Insurance providers have expanded online services, making them attractive targets for threat actors. Unlike banking attacks focused on financial transactions, compromised insurance accounts often contain extensive personal information, identity documents, policy records, and payment methods. This data can support fraud beyond the initial compromise.

Coordinated Campaigns and Global Reach

The investigation identified a coordinated phishing operation targeting multiple insurance providers across several regions. This campaign reused the same operational infrastructure across numerous insurance brands, adapting language, branding, and content for local markets. Saudi Arabia was a primary target, with additional activity observed in Europe, the United States, and India.

Google Ads as an Attack Vector

A notable observation was the consistent use of sponsored Google advertisements as the primary delivery mechanism for these phishing campaigns. This represents a shift from traditional phishing emails or SMS campaigns.