CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking

**Executive summary:** This CTI report describes coordinated insurance-themed phishing campaigns that leverage paid Google Ads and disposable cloud-hosted landing pages to perform real-time session hijacking—relaying OTPs and authenticating to genuine insurance portals during a victim's active session—supported by a purpose-built phishing framework called "InsureOTP" that provides live session management, backend dashboards, Telegram integrations, and other operational tooling; defenders are advised to monitor paid-ad abuse, lookalike domains, disposable hosting, and anomalous authentication patterns to detect and disrupt these attacks.