As reported by The Hacker News, citing research from CTM360, insurance-sector phishing operations have undergone a fundamental architectural shift — moving away from static credential harvesting toward real-time, adversary-in-the-middle (AiTM) session interception. This is not an incremental improvement in attacker tradecraft; it represents a category change that invalidates many of the control assumptions defenders have relied on for years.
Why This Matters: The MFA Assumption Is Broken
The security community spent the better part of a decade pushing multi-factor authentication as the primary antidote to credential phishing. That prescription was sound when attackers were collecting usernames and passwords for later use — MFA created a time-based barrier that often made stolen credentials worthless before they could be weaponized.
AiTM infrastructure eliminates that barrier entirely. By proxying the authentication session in real time, attackers capture not just credentials but authenticated session tokens — cookies and bearer tokens that have already passed MFA validation. The victim completes their login, satisfies the MFA prompt, and believes nothing unusual has occurred, while the attacker simultaneously acquires a fully authenticated session that can be replayed from anywhere in the world.
The attacker is no longer stealing your keys — they're riding in the car with you as you unlock the door.
This matters acutely for the insurance sector. Insurance portals routinely provide access to highly sensitive personal and financial data: policy details, beneficiary information, claims history, and in some cases, direct payment or disbursement functions. A single hijacked session can enable account takeover, fraudulent claims submission, or sensitive data exfiltration — all within minutes of a victim clicking a phishing link.
Who Is Most Exposed
While insurance companies are the named targets in this research, the implications extend broadly:
The Attacker Toolkit: What's Enabling This Shift
The commoditization of AiTM phishing frameworks has dramatically lowered the barrier to entry. Open-source tools capable of real-time proxy interception are freely available, and phishing-as-a-service platforms have begun incorporating these capabilities into turnkey offerings. The insurance vertical is attractive precisely because it has historically lagged behind banking in deployment of advanced authentication controls, while still providing access to significant financial and personal data assets.
The operational profile of these campaigns also reflects greater sophistication in target selection and lure quality. Generic credential phishing relied on volume; AiTM operations are more surgical, often involving domain squatting, typosquatting on insurer brand names, and SSL certificates that give victims no visual warning that they're on a malicious proxy site.
Shield53 Recommendations
Immediate Actions for Insurance Organizations and Enterprises
- Deploy FIDO2/WebAuthn phishing-resistant MFA — hardware security keys (YubiKey, etc.) and passkeys are cryptographically bound to the legitimate origin domain, making them immune to AiTM proxy attacks. This is the single highest-impact control change available.
- Implement Conditional Access with token binding and device compliance checks — session tokens stolen via AiTM can be partially mitigated by requiring device compliance signals that a replay attack cannot satisfy.
- Enable anomalous session detection — monitor for authentication sessions followed immediately by logins from geographically or ASN-inconsistent IP addresses. AiTM attacks frequently result in a legitimate user session from one location and an attacker session from another, within seconds of each other.
- Audit session token lifetimes — short-lived tokens with strict re-authentication requirements limit the window of exposure after a successful AiTM capture. Review idle session timeout and token expiration policies across all customer-facing portals.
- Deploy anti-phishing DNS controls and browser isolation for high-risk user populations such as agents, brokers, and claims adjusters.
- Conduct brand monitoring for lookalike domains targeting your organization's customer-facing portals — proactive takedown of AiTM infrastructure before it reaches victims is far more effective than post-compromise response.
For End Users and Policyholders
- Treat any unsolicited link to an insurance portal with extreme suspicion, regardless of how professional it appears or whether the site shows a padlock/HTTPS.
- Navigate directly to insurer websites by typing addresses manually or using saved bookmarks rather than following email or SMS links.
- Enable account activity notifications where available — many AiTM attacks trigger rapid downstream actions that an alert could catch before significant damage occurs.
The Broader Signal
This evolution in phishing methodology is a harbinger, not an anomaly. As MFA adoption has increased across the enterprise, attackers have adapted — and AiTM techniques will increasingly appear across every sector that deploys customer-facing authenticated portals. The industry must move the conversation beyond "MFA vs. no MFA" to "which MFA is phishing-resistant and how are we detecting session anomalies in real time." Organizations that don't make this transition in the next 12-18 months will find themselves defending against an attack class for which their current controls provide no meaningful protection.
