Insurance Sector Phishing Has Evolved to Real-Time AiTM

CTM360’s latest research, covered by The Hacker News, documents a shift that’s been building for a while: phishing campaigns targeting insurance companies have moved past credential harvesting and are running real-time account takeover operations using adversary-in-the-middle (AiTM) infrastructure.

The old model was simple. Lure the victim to a credential page. Collect the username and password. Try to log in later. The problem was that MFA — even SMS or TOTP codes — interrupted this: the attacker had the password but couldn’t pass the second factor without being in the session at that exact moment.

AiTM phishing proxies solve that problem. Instead of collecting credentials for later replay, the phishing kit sits transparently between the victim and the legitimate service. The victim submits their password; it goes to the real site. The real site sends an MFA challenge; the victim sees it through the proxy and completes it. The proxy captures the resulting authenticated session token — the credential the server issued once authentication was complete. That token doesn’t require MFA to use; it’s proof that authentication already happened.

CTM360 documented this approach applied specifically to insurance-sector targeting. What’s been a generalized technique in enterprise credential theft — Microsoft 365 AiTM campaigns have been documented for at least two years, including the Kratos phishing kit taken down in a joint operation last week — is now reaching verticals that were previously targeted with less sophisticated methods.

Why insurance

Insurance companies sit at a useful intersection for attackers. They hold sensitive policyholder data — PII, medical records in health lines, financial records, claims history — and process payments against real claims. External-facing portals exist for customers, agents, and partners. A compromised account, depending on the role, can mean access to large volumes of sensitive records, the ability to redirect claim disbursements, or policy modification rights.

The credential-harvesting model ran into MFA and mostly stopped. Real-time session capture doesn’t care about the second factor, so the upgrade was logical.

What the transition means for defense

AiTM doesn’t remove the social engineering requirement. Entry is still an email or message that creates a pretext for clicking a link. That means the same defenses that apply to phishing generally still apply: URL inspection at the email gateway, domain reputation filtering, and login anomaly detection that flags a legitimate session token appearing from an unexpected location or device. Those layers still matter.

What the transition eliminates is the assumption that MFA is the final line. MFA protects against credential stuffing and offline replay — an attacker who has a password but no physical access to the second factor. It was not designed to protect against a proxy that passes the victim’s MFA response in real time. That capability gap has been exploited broadly in enterprise M365 targeting and is now documented in the insurance vertical too.

The authentication standard that actually resists AiTM: phishing-resistant authenticators — FIDO2/WebAuthn hardware keys or device-bound passkeys. The authentication ceremony in these standards is cryptographically bound to the origin domain. A proxy can’t satisfy a FIDO2 challenge for a different domain, even a convincing lookalike. The session token that results from a successful passkey login is still as vulnerable as any other session token to device compromise, but the proxy can’t complete the login in the first place.

FIDO2 rollout remains slow in most organizations. That gap is what CTM360 is documenting — not a flaw in the phishing-resistant standards themselves, but in how far those standards have actually propagated into production environments.

The pattern

This is the same arc that played out with basic credential phishing, then with TOTP bypass, now with real-time session capture. The attackers aren’t finding new vulnerabilities; they’re optimizing the attack chain to get past whatever authentication control is currently considered sufficient. The answer to that arc is not another round of “attackers are sophisticated” coverage. It’s moving faster on FIDO2 than the industry has been willing to.

The CTM360 finding matters because it names a specific vertical that has been targeted with mature tooling. If your organization operates in insurance — or handles insurance customer data — the risk profile on session token protection just shifted.

---

Source: CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking — The Hacker News, July 25, 2026.