Inside DevMan RaaS: How the Centralized Cybercrime Portal Automates Payloads, Victims, and Payouts

Credit: CTM360/Blogger[cite: 1]

The InsureTrap: Real-Time Phishing & Account Hijacking Through Fake Insurance Portals[cite: 1]

The Structural Shift from Static Credential Harvesting to Real-Time Session Interception[cite: 1]

For over two decades, the cybercrime playbook governing phishing campaigns remained remarkably static[cite: 1]. Threat actors deployed deceptive emails, SMS messages, or rogue links directing unsuspecting victims to rudimentary landing pages designed to capture static login credentials[cite: 1].

Image Credit: All images sourced from CTM360 via Blogger - insuretrap.jpg used for illustrative and educational purposes within this threat intelligence article.[cite: 1]

Once collected, these usernames and passwords were warehoused, batched, or monetized on underground forums, leaving a measurable time lag between initial compromise and subsequent account abuse[cite: 1]. Security operations centers (SOCs) and fraud teams built entire detection models around this latency, assuming defenders enjoyed a comfortable window to flag anomalous logins, reset compromised passwords, and invalidate stolen sessions before catastrophic financial or operational damage materialized[cite: 1].

Paradigm Shattered: That foundational assumption has been comprehensively shattered[cite: 1]. Recent threat intelligence findings published by CTM360 expose a fundamental paradigm shift in cybercriminal methodology[cite: 1]. Rather than hoarding credentials for delayed exploitation, modern threat actors orchestrate synchronized, real-time attacks that unfold entirely within a single active user session[cite: 1].

As victims interact with convincing digital facades, attackers simultaneously authenticate against legitimate corporate infrastructure, effectively turning the phishing interface into a live bridge between the targeted user and the authentic service provider[cite: 1].

Anatomy of the Traditional Phishing Playbook Versus Synchronized Authentication[cite: 1]

The traditional phishing model relied heavily on asynchronous collection[cite: 1]. An attacker cast a wide net, harvested raw text credentials, and stored them in backend databases for future automated stuffing attacks or manual login attempts[cite: 1]. This approach faced significant friction as enterprises deployed robust identity and access management (IAM) controls, context-aware security policies, and mandatory multi-factor authentication (MFA)[cite: 1].

Real-Time Operational Alignment: Synchronized authentication neutralizes these protective barriers[cite: 1]. When a target inputs their credentials into a malicious portal, the phishing platform instantly proxies those inputs into the authentic corporate login portal[cite: 1]. If the legitimate system issues a security challenge—such as a time-based OTP—the fraudulent intermediary immediately relays that challenge back to the victim's browser[cite: 1].

The victim, believing they are completing a standard routine verification step for an insurance quotation or policy update, inputs the OTP into the phishing form[cite: 1]. The kit captures the code on the fly and pushes it back to the genuine portal before expiration[cite: 1]. The attacker gains authenticated session access instantaneously, completely bypassing the asynchronous lag that previously allowed defenders time to react[cite: 1].

Weaponizing Multi-Factor Authentication via Live OTP Relay Architectures[cite: 1]

Image Credit: All images sourced from CTM360 via Blogger - insuretrap.jpg used for illustrative and educational purposes within this threat intelligence article.[cite: 1]

Multi-factor authentication was widely heralded as the ultimate silver bullet against credential-based attacks[cite: 1]. Yet, the evolution of adversary-in-the-middle (AitM) frameworks and live OTP relay kits demonstrates that authentication controls are only as secure as the human endpoints interacting with them[cite: 1]. Modern phishing kits do not merely circumvent MFA; they weaponize the human user's trust in the authentication process itself[cite: 1].

"In the operations uncovered by CTM360, the malicious interface dynamically updates based on the exact responses received from the legitimate backend. If an entered OTP is incorrect or expired, the backend administrative dashboard signals the operator, who can instantly prompt the victim for a re-submission." - CTM360 THREAT RESEARCH[cite: 1]

This seamless interactive feedback loop ensures that session establishment succeeds under the guise of legitimate system friction[cite: 1]. By managing the authentication handshake step-by-step alongside the victim, threat actors neutralize the security assurances traditionally conferred by secondary verification tokens, rendering standard MFA deployments vulnerable to active session hijacking[cite: 1].

The Expanding Digital Footprint of Modern Insurance Portals as High-Value Targets[cite: 1]

The digital transformation of the insurance industry has accelerated at a staggering pace[cite: 1]. To remain competitive and satisfy consumer demand for frictionless digital experiences, insurers have migrated massive swathes of their operational workflows online[cite: 1]. Policyholders can now purchase comprehensive coverage, renew existing contracts, submit complex claims, manage billing methods, and update sensitive personal records entirely through self-service web portals and mobile applications[cite: 1].

While this digital expansion drastically reduces administrative overhead and enhances user convenience, it simultaneously broadens the surface area for malicious exploitation[cite: 1]. Insurance ecosystems present an exceptionally lucrative target profile for sophisticated threat actors, often surpassing traditional banking targets in terms of the sheer depth and longevity of actionable data accessible upon successful account compromise[cite: 1].

Why Insurance Ecosystems Attract Sophisticated Cybercriminals[cite: 1]

Financial institutions and payment processors have long been hardened targets, equipped with advanced fraud detection algorithms, real-time transaction monitoring, and stringent regulatory oversight that immediately flags anomalous fund movements[cite: 1]. Insurance portals, conversely, historically operated under lower transaction velocities, focusing heavily on customer retention and onboarding speed[cite: 1]. Consequently, security monitoring across secondary insurance workflows has occasionally lagged behind primary banking infrastructure[cite: 1].

Operational Advantage for Attackers: Unlike a stolen credit card number that can be rapidly blocked or a bank account experiencing unauthorized wire transfers, an insurance account often remains active and unnoticed by the rightful owner for extended periods[cite: 1]. Because policyholders do not log into their insurance portals daily or weekly, unauthorized access can persist silently[cite: 1].

This allows attackers ample time to harvest intelligence, manipulate coverage details, or orchestrate secondary identity frauds without immediate detection[cite: 1].

The Richness of Compromised Policy Data and Identity Records[cite: 1]

The intrinsic value of an insurance account extends far beyond immediate financial theft[cite: 1]. A single compromised profile frequently contains a comprehensive dossier of personally identifiable information (PII)[cite: 1]. This includes full legal names, residential addresses, employment histories, vehicle identification numbers (VINs), property details, banking credentials, and scanned copies of government-issued identity documents submitted during underwriting or claims processing[cite: 1].

• ID: Full PII Dossiers[cite: 1]
• Property Records: Detailed ownership and valuation metrics[cite: 1]
• VIN & Vehicle Data: Specific asset information[cite: 1]
• Govt ID Scans: High-trust verification documents[cite: 1]

This rich repository of data functions as raw fuel for sophisticated, multi-stage cybercrime syndicates[cite: 1]. The acquired documents and PII can be leveraged to execute synthetic identity fraud, open fraudulent lines of credit, facilitate targeted corporate espionage, or launch highly convincing spear-phishing campaigns against the victim's broader network[cite: 1]. By targeting insurance providers, threat actors secure a centralized trove of verified identity records that dwarf the monetary value of simple credit card credentials[cite: 1].

Operational Mechanics: Google Ads and Disposable Cloud Infrastructure[cite: 1]

Modern cybercriminal campaigns operate with the structural efficiency and strategic precision of modern technology startups[cite: 1]. Gone are the days of relying exclusively on mass unsolicited email blasts that are easily flagged and neutralized by cloud email security gateways[cite: 1]. Today's threat actors invest considerable capital and technical sophistication into acquiring traffic, bypassing perimeter defenses, and maintaining infrastructural resilience through disposable cloud services[cite: 1].

The operational architecture documented by CTM360 highlights a calculated reliance on mainstream digital marketing channels and cloud-native hosting providers[cite: 1]. By embedding themselves within legitimate traffic acquisition pipelines, attackers bypass traditional perimeter filters entirely, placing their fraudulent assets directly in front of highly motivated, high-intent victims actively seeking insurance services[cite: 1].

Exploiting Search Engine Advertising[cite: 1]

Rather than waiting for victims to stumble upon rogue domains via spam links, threat actors actively purchase paid search placements targeting high-volume keywords related to insurance quotations, policy renewals, and price comparisons[cite: 1]. When potential victims search terms such as "Compare car insurance offers" or "Cheapest third-party insurance," prominent sponsored advertisements appear at the top of the search engine results page[cite: 1].

Geographic Targeting & Cloud Hosting Agility[cite: 1]

Geographically, the campaign exhibited a wide operational footprint while focusing heavily on specific high-value regional markets[cite: 1]. Saudi Arabia emerged as the primary target for this specific wave of activity, while researchers also tracked parallel operations deployed across Europe, the United States, and India, demonstrating the campaign's modularity and adaptability to diverse regulatory and linguistic environments[cite: 1].

• SA Primary Target: Saudi Arabia insurance quotation phishing at scale[cite: 1].
• Parallel Operations: Europe, United States, and India tracked simultaneously[cite: 1].

Maintaining infrastructure resilience is a paramount priority[cite: 1]. The investigated campaigns frequently leveraged cloud services, GitHub Pages, Netlify, Hostinger, Wix, Lovable, and various other legitimate web-building utilities to host their deceptive interfaces[cite: 1]. By utilizing randomized domains completely disconnected from traditional insurance terminology, operators achieve remarkable agility—if a specific landing page is flagged and blocked, the syndicate can instantaneously spin up new infrastructure across alternative cloud providers[cite: 1].

Inside the InsureOTP Kit: The Rise of Operational Phishing Frameworks[cite: 1]

The sophistication of contemporary phishing campaigns is anchored by advanced software engineering[cite: 1]. Phishing kits have outgrown their historical reputation as simple, static archives of stolen HTML and PHP files[cite: 1]. Today, they function as fully fledged operational platforms equipped with backend management interfaces, real-time telemetry, and modular exfiltration pipelines[cite: 1].

During their deep-dive investigation into these coordinated attacks, CTM360 researchers uncovered and documented a previously unidentified framework designated as the InsureOTP Kit[cite: 1]. Purpose-built specifically for insurance-themed fraud, this kit represents a significant milestone in the industrialization of cybercrime tooling[cite: 1].

Backend Administration, Live Dashboards, and Telegram Bot Integration[cite: 1]

The InsureOTP Kit shifts the operational paradigm from passive data collection to active campaign management[cite: 1]. Unlike legacy kits that silently dumped captured text strings into hidden text files, this framework provides threat actors with sophisticated backend administrative dashboards designed for real-time victim monitoring[cite: 1].

Observed Capabilities within the InsureOTP Architecture:[cite: 1]

• Live Victim Monitoring: Operators observe victim interactions across multi-step quotation and login workflows in real time, tracking exactly which form fields have been completed[cite: 1].
• Manual Approval Workflows: Attackers maintain the ability to manually trigger secondary prompts or approve authentication stages based on real-time responses from legitimate corporate portals[cite: 1].
• Telegram Bot Integration: Many variants leverage Telegram Bot APIs to transmit structured victim submissions—including credentials, PII, and intercepted OTP codes—directly to private attacker-controlled channels instantly[cite: 1].
• Direct Backend API Communication: The framework supports robust backend communication channels, allowing seamless data synchronization across multiple distributed operator nodes[cite: 1].
• Dynamic OTP Handling: When authentication challenges fail or expire, the backend interface enables operators to dynamically request secondary verification codes from the victim without disrupting the illusion of a standard system error[cite: 1].

Exposed Archives and the Value of Comprehensive Threat Intelligence[cite: 1]

One of the most critical breakthroughs in modern cyber threat intelligence occurs when analysts pierce the operational veil to examine the internal mechanics of adversary infrastructure[cite: 1]. During the CTM360 investigation, researchers identified publicly accessible backend resources left exposed by misconfigured deployment scripts associated with the phishing network[cite: 1].

Breakthrough Discovery: Analysis of these exposed archives yielded administrative components, backend source code, SQLite databases, and operational logs that mapped the complete lifecycle of the campaign[cite: 1]. This discovery underscores a fundamental shift in how security organizations must evaluate threats—moving beyond the superficial question of "Where is the phishing page?" to "How does the campaign operate?"[cite: 1]

By dissecting backend source code, database schemas, and tooling frameworks, defenders gain actionable visibility into adversary tactics, techniques, and procedures (TTPs), enabling proactive disruption well before new attack waves reach production environments[cite: 1].

Redefining Enterprise Defense: Moving Beyond Basic Domain Blocklists[cite: 1]

The evolution of insurance phishing into real-time session hijacking exposes the inherent limitations of legacy security frameworks[cite: 1]. Organizations that rely exclusively on traditional Digital Risk Protection (DRP) strategies—such as monitoring for lookalike domains and issuing automated takedown notices—find themselves perpetually reacting to symptoms rather than neutralizing root causes[cite: 1].

Because attackers can spin up disposable cloud-hosted infrastructure in minutes and execute real-time authentication proxying, static defenses deployed at the perimeter are easily bypassed[cite: 1]. To protect consumer-facing portals and maintain brand integrity, enterprise security programs must undergo a structural transformation[cite: 1].

The Shortcomings of Traditional Digital Risk Protection Approaches[cite: 1]

Traditional DRP platforms historically focused on external asset discovery, cataloging typosquatted domains, and scanning public app stores for brand impersonation[cite: 1]. While these capabilities remain foundational, they operate on a delayed feedback loop[cite: 1]. By the time a fraudulent domain is identified, verified, and subjected to a registrar takedown, the threat actors have often cycled through multiple fresh hosting providers or completed their primary wave of targeted account compromises[cite: 1].

Time Is No Longer on the Defender's Side: Furthermore, traditional incident response assumptions predicated on an operational delay between credential theft and account abuse are no longer valid[cite: 1]. When credential harvesting and session-time compromise occur concurrently within a single browsing session, reactive password resets and post-incident forensic audits arrive far too late[cite: 1].

Actionable Strategies for Securing Consumer-Facing Portals Against Live Session Hijacking[cite: 1]

Defending against real-time account hijacking requires a multi-layered, intelligence-driven security posture:[cite: 1]

• Deploy Continuous Brand and Paid Search Monitoring: Organizations must actively monitor major search engine advertising networks for unauthorized or abusive use of their brand names, trademarks, and proprietary quotation terminology[cite: 1].
• Implement Advanced Bot and Session Risk Detection: Internal IAM and portal architectures must integrate sophisticated bot-detection and device-fingerprinting technologies capable of identifying automated proxying and headless browsers[cite: 1].
• Adopt Phishing-Resistant Authentication Standards: Accelerate adoption of FIDO2/WebAuthn hardware keys or passkeys, which cryptographically bind the authentication session to the legitimate origin and neutralize real-time OTP relay attacks[cite: 1].
• Embrace Comprehensive Cyber Threat Intelligence (CTI): Transition from isolated IoCs to contextual threat intelligence[cite: 1]. Understanding adversary tooling like InsureOTP empowers proactive disruption[cite: 1].

Conclusion[cite: 1]

The findings unveiled by CTM360 regarding the evolution of insurance phishing into real-time account hijacking serve as a stark wake-up call for the broader cybersecurity and financial services sectors[cite: 1]. The convergence of intent-driven search engine advertising, disposable cloud-native infrastructure, and sophisticated operational frameworks like the InsureOTP Kit demonstrates that cybercrime has reached an unprecedented level of industrial efficiency[cite: 1].

As threat actors abandon passive data hoarding in favor of synchronized, session-time compromise, the traditional boundaries separating perimeter defense, fraud prevention, and threat intelligence continue to dissolve[cite: 1]. Safeguarding modern digital ecosystems requires an uncompromising commitment to proactive intelligence, resilient authentication architectures, and continuous external visibility[cite: 1]. Only by understanding the complete operational lifecycle of the adversary can organizations effectively disrupt threats before they breach the perimeter[cite: 1].

Reference: CTM360 Threat Research on Insurance Phishing & Real-Time Session Hijacking[cite: 1]

Frequently Asked Questions[cite: 1]

1. What is the core finding of CTM360's research regarding modern insurance phishing?[cite: 1]

CTM360 discovered that phishing campaigns targeting insurance providers have evolved from static credential-harvesting operations into synchronized, real-time account hijacking attacks where threat actors authenticate against legitimate portals concurrently with the victim's login session[cite: 1].

2. How do threat actors utilize sponsored Google Ads in these campaigns?[cite: 1]

Attackers purchase sponsored search engine advertisements targeting high-intent keywords such as car insurance quotations and price comparisons, positioning fraudulent links at the top of search results to drive direct traffic to deceptive phishing portals[cite: 1].

3. What is the InsureOTP Kit and what operational capabilities does it provide?[cite: 1]

The InsureOTP Kit is a purpose-built phishing framework identified during the research that offers threat actors real-time victim monitoring, backend administrative dashboards, manual approval workflows, dynamic OTP handling, and direct Telegram Bot integrations[cite: 1].

4. Which geographic regions were primarily targeted by this coordinated campaign?[cite: 1]

While the campaign exhibited a global operational footprint spanning Europe, the United States, and India, Saudi Arabia was identified as the primary target for this specific coordinated wave of insurance phishing activity[cite: 1].

5. Why are traditional incident response models insufficient against session-time compromise?[cite: 1]

Traditional incident response assumes a time lag between credential theft and account abuse[cite: 1]. Because modern campaigns execute credential harvesting, OTP interception, and session authentication simultaneously within a single session, unauthorized access occurs before traditional detection mechanisms can react[cite: 1].