# The Policy Scam That Logs In Before You Even Click Submit
You searched for car insurance. Clicked the top result. Filled in your vehicle details. Entered your username and password. Hit submit.
Somewhere else, an attacker just logged into your actual insurance account. You're still on the phishing page. The session hasn't even ended.
That's the new architecture of insurance phishing, documented in fresh research from CTM360. It's not credential harvesting in the traditional sense — steal now, exploit later. It's synchronous account takeover. The attacker proxies your authentication in real time, relaying your inputs to the legitimate portal and capturing the session token before you've noticed anything unusual. By the time you close the browser tab, your account may already have a new email address, a new phone number, and a pending policy change.
## Why Insurance, Why Now
Financial phishing has long fixated on banks. The logic was obvious: money lives in bank accounts, bank accounts can be drained quickly.
Insurance accounts don't work that way — and that's exactly why they're becoming more valuable, not less.
Modern insurance portals are extraordinarily data-rich environments. Log into a typical auto insurer and you'll find vehicle identification numbers, home addresses, named drivers, payment instruments, and often uploaded copies of licenses or registration documents. Life and health policy portals go further: income declarations, beneficiary names, and disclosed medical history. Submit a claim through the portal and you've handed attackers a detailed narrative of your property, your health, and your household.
Fraudsters can do a lot with that. Policy modification fraud — rerouting claims payments, changing beneficiaries, updating vehicle details before a staged accident — is already a documented abuse pattern. Identity fraud enabled by the document trove compounds the exposure well beyond what the initial phishing campaign appears to target.
The research identified campaigns hitting insurance providers across Saudi Arabia, Europe, the United States, and India. The same underlying infrastructure rotated across brands, adapting language and visual identity to match local markets. This isn't one crew with one target. It's closer to a franchise model: standardized tools, localized execution.
## Google Ate Your Security Awareness Training
Here's the detail that deserves more attention than it's getting: this campaign isn't distributing phishing emails.
Attackers are buying Google Ads.
Sponsored results appearing for queries like "cheapest third-party insurance" or "compare car insurance offers" direct users to phishing pages. The victims are people with purchase intent — actively shopping, already primed to trust whatever the search engine surfaces. They're not clicking something suspicious in their inbox. They're doing exactly what they were taught to do: going directly to the search engine rather than following email links.
Every piece of security awareness training that advises users to "search for the company directly instead of clicking links in emails" has just become a liability for this specific attack pattern. The phishing site *is* the top search result.
The infrastructure underneath reinforces this. Operators hosted campaigns on GitHub Pages, Netlify, Wix, Hostinger, and other legitimate cloud platforms. Valid TLS certificates. Real CDN uptime. No typosquatted domain to flag. The browser padlock is present. The URL might be randomized garbage — q7x4k-insurance-compare.netlify.app — but that's only suspicious to someone who thought to look.
Traditional brand monitoring won't catch it either. When campaigns rotate through dozens of disposable subdomains on legitimate platforms rather than parking on a single dedicated malicious host, domain reputation lists are perpetually behind.
## The Defeat of the Expiring Code
What's technically new in the AiTM model isn't the proxy concept — tools like Evilginx and EvilProxy have enabled adversary-in-the-middle phishing since at least 2021, and Microsoft documented a campaign hitting over 10,000 organizations that way in 2022. What's changed is the targeting breadth and operational tempo.
Traditional MFA using one-time codes — TOTP apps, SMS — provides no protection here. The attack doesn't need your MFA code to persist past its expiration window. It relays it in real time. You enter the six-digit code, the proxy forwards it to the real portal, the portal accepts it, and the session token comes back to the attacker. The code expires thirty seconds later. Doesn't matter.
This is the uncomfortable truth that the security industry has been slow to communicate clearly: TOTP-based MFA protects against credential stuffing. It does not protect against real-time phishing. The threat model was always different. The attacks have caught up to that distinction.
## HackWire Analysis
The insurance vertical's move up the phishing target hierarchy isn't accidental — it reflects a maturation in how criminal operations evaluate data value. The pivot away from banking has been building for two years, driven partly by improved fraud controls at major financial institutions and partly by the realization that insurance data is a slow-burn asset. A stolen bank credential might be burned within hours as fraud detection triggers. A compromised insurance account with rerouted contact information can sit quietly, enabling staged claims, identity fraud, and social engineering attacks on family members over months.
The Google Ads vector is where I think the security industry is underreacting. Ad-based malware distribution (malvertising) is well-documented. But ad-based *phishing* — where the ads look entirely clean, promote a plausible service, and simply land on a high-fidelity spoofed portal — is harder to detect and harder to teach users to avoid. Google's ad review processes weren't designed to catch a page that *accurately* resembles an insurance quote form. The content is unremarkable. The offense is the redirect.
Defenders at insurance carriers should be running proactive searches on their own brand terms and reviewing sponsored results. Abuse teams at Google should hear from you directly when campaigns are live — volume matters for prioritization. For the authentication architecture question, only FIDO2 hardware security keys and passkeys provide genuine protection against AiTM, because the credential is domain-bound at the cryptographic layer and will not authenticate against a proxy site regardless of how convincing it looks. Organizations still running TOTP as their MFA ceiling should treat this research as a forcing function to revisit that decision.
The middle market — regional insurers, specialty carriers, brokers with direct customer portals — is likely most exposed. They have the data richness of large carriers without the dedicated fraud and threat intelligence teams to match.
— HackWire Editorial
---