Insurance Phishing Moves to Real-Time Account Hijacking

For most of the past decade, phishing against financial institutions operated on a comfortable lag. Attackers sent a convincing email, harvested credentials when someone bit, then accessed the account sometime later — hours, days, occasionally weeks — when circumstances aligned. MFA adoption was supposed to close that window. Time-based codes expire. Push notifications are contextual. The gap between “attacker has the password” and “attacker is in the account” was exactly where MFA was meant to live.

CTM360’s recent analysis of insurance-focused phishing operations, covered by The Hacker News on July 25, documents the expected evolution: attackers have moved the window. Instead of harvesting credentials for later use, these campaigns operate as real-time proxies — relaying the victim’s session between the phishing page and the legitimate insurer portal simultaneously, capturing the authenticated session cookie the moment the victim completes MFA. By the time the victim believes they’ve logged in successfully, the attacker has an active session.

This is adversary-in-the-middle (AiTM) phishing — toolkits that act as transparent reverse proxies, relaying authentication flows live. The technique has been in the threat actor toolkit since at least 2021, with platforms like Evilginx and EvilProxy well-documented in research community writeups. What’s notable in CTM360’s findings is where the targeting has shifted: insurance portals, which have lagged in adopting phishing-resistant authentication and tend to serve customer populations less practiced at spotting a proxied login flow. Earlier this month, a dismantled kit called Kratos illustrated how the same class of attack is being industrialized against Microsoft 365 portals — the same technique, a different vertical.

Insurance accounts offer a particular kind of payoff. Compromised policyholder access enables fraudulent claims, policy beneficiary changes, and personal information harvesting that can take weeks to surface through normal fraud detection. The dwell time between unauthorized access and detected harm is longer than a financial institution with real-time transaction monitoring. That’s not a new vulnerability in the operational sense, but it’s the characteristic that makes this a worthwhile target for commodity phishing infrastructure rather than tailored campaigns.

The mitigation picture is well-established. FIDO2-based authentication — hardware tokens, passkeys, platform authenticators tied to a specific device — is the category of MFA that doesn’t yield to a proxy: the credential is cryptographically bound to the origin domain, so there’s nothing for the attacker to relay. TOTP codes and push notifications are not in that category. They authenticate the user but not the session channel, which is precisely the gap AiTM attacks exploit. Organizations running high-value account portals on the older MFA patterns should treat the CTM360 data as confirmation of a known trajectory, not a new threat category.

What has changed in the CTM360 picture is the operational profile of these attacks. Earlier AiTM campaigns tended to be focused, targeted at specific institutions. These appear closer to commodity operations — running at volume without per-target customization. The effort-per-victim cost for real-time session hijacking has come down to match what credential harvesting looked like a few years ago. When a technique previously associated with sophisticated targeting becomes infrastructure anyone can rent, the audience of organizations at risk stops being a short list of named banks and starts being the whole sector.

The same transition played out against banks and cryptocurrency exchanges before it arrived at insurance. Phishing kits for crypto wallets ran a nearly identical playbook — real-time proxying, session hijacking, the same FIDO2 blind spot. Attackers go where the authentication is weakest relative to the value being protected. The organizations that aren’t in these writeups are the ones that deployed phishing-resistant MFA. That’s still a small list.