Cybercriminals Evolve Phishing Campaign into Real-Time Insurance Account Hijacking

LONDON (July 25, 2026) — A sophisticated cyberattack targeting insurance providers globally has escalated from standard phishing attempts to real-time account hijacking, utilizing Google Ads and one-time password relay techniques to bypass security controls. The operation, identified by cybersecurity researchers at CTM360 Research on Friday morning, represents a significant shift in how threat actors compromise sensitive financial data.

The campaign initially deployed fraudulent emails designed to mimic legitimate communications from major insurance carriers. Unlike previous operations that relied solely on credential harvesting, this group has integrated automated systems capable of intercepting authentication codes the moment they are generated. By leveraging Google Ads infrastructure to host deceptive landing pages and employing OTP relay mechanisms, attackers can instantly transfer verification codes to their own devices, effectively locking out legitimate users while assuming control of accounts.

While activity has been detected across Europe, India, and the United States, Saudi Arabia remains the primary epicenter of the intrusion. The geographic concentration suggests a coordinated effort targeting specific regional markets where insurance policies often contain high-value personal data and financial reserves. Security analysts indicate that the attackers are not merely stealing login credentials but are actively managing compromised accounts to facilitate fraud beyond the initial breach.

The sophistication of the attack lies in its speed. Traditional multi-factor authentication, designed as a final barrier against unauthorized access, has been rendered ineffective by the real-time relaying method. Once an insurance customer enters their username and password on a spoofed page, the system immediately triggers a verification code request to the victim's mobile device or email. The attackers' relay network captures this code within seconds and submits it automatically, completing the login process before the user can react.

Insurance firms in affected regions have begun implementing emergency protocols, including forced password resets and temporary suspension of digital account access for high-risk users. However, the use of legitimate advertising platforms to host phishing infrastructure complicates mitigation efforts, as these domains often evade standard blacklists until significant damage occurs.

The ultimate objective appears to be long-term fraud rather than immediate data theft. By maintaining active control over insurance accounts, threat actors can alter policy details, redirect claim payments, or access sensitive personal information for identity theft operations in subsequent phases. The full extent of the financial impact remains unclear as many victims are unaware their credentials have been compromised until fraudulent transactions appear.

Questions remain regarding whether this operation is linked to known criminal syndicates previously active in the Middle East and South Asia sectors. As investigators work to trace the funding channels behind the Google Ads campaigns, experts warn that similar techniques could soon be adapted by other groups targeting banking or healthcare systems.