Imagine your CEO receives a perfectly legitimate Microsoft 365 login page. Everything looks normal. They enter their credentials, complete the MFA prompt, and continue with their day.
Minutes later, attackers are inside your organization’s email, calendar, and confidential files.
This isn’t your average phishing attack. It’s Adversary-in-the-Middle (AiTM): a sophisticated cyberattack designed to intercept both passwords and MFA tokens in real-time. Traditional security defenses often fall short against it.
In this post, we break down how AiTM attacks work, the clever tactics behind them (like reverse proxies and evasion tricks), and most importantly, how you can defend your organization against them.
Minutes later, attackers are inside your organization's email, calendar, and confidential files.
This isn't your average phishing attack. It's Adversary-in-the-Middle (AiTM): a sophisticated cyberattack designed to intercept both passwords and MFA tokens in real-time. Traditional security defenses often fall short against it.
In this post, we break down how AiTM attacks work, the clever tactics behind them (like reverse proxies and evasion tricks), and most importantly, how you can defend your organization against them.
What is AiTM?
Adversary-in-the-Middle (AiTM) attacks intercept communication between a user and a legitimate service, such as email platforms, banking portals, or cloud apps.
Unlike traditional phishing, which only tricks users into submitting their credentials, AiTM proxies traffic in real-time, capturing not just usernames and passwords but also session cookies and MFA codes. This allows attackers to bypass Multi-Factor Authentication (MFA) and take over active sessions without detection.
How AiTM Works
- User receives a phishing link (usually disguised as a Microsoft 365 or other familiar login page).
- The link leads to an AiTM phishing site that uses a reverse proxy (e.g., Evilginx, Modlishka).
A fake Microsoft login page requesting the target's password.
- When the user enters their username, password, and MFA code, the reverse proxy relays that information to the real site and establishes a valid session.
- The attacker steals the session cookie, bypassing MFA, and logs in as the user, gaining full access.
A fake Microsoft MFA page requesting a verification code.
The Growing Threat of AiTM Attacks
Adversary-in-the-Middle (AiTM) attacks have evolved into highly sophisticated threats that extend far beyond basic credential theft. Cybercriminals now leverage AiTM techniques to manipulate data, eavesdrop on communications, and deploy malware, all while remaining undetected.
Common Forms of AiTM Attacks:
- Credential Harvesting: Attackers intercept login credentials in real time, bypassing multi-factor authentication (MFA) by stealing session cookies. Example: Fake login pages mimicking Microsoft 365 or banking portals.
- Data Manipulation: Attackers alter data mid-transmission, changing transaction details, injecting malicious scripts, or falsifying records. Impact: Financial fraud, supply chain sabotage, or regulatory violations.
- Eavesdropping (Passive AiTM): Attackers silently monitor unencrypted communications (emails, chats, file transfers) to steal intellectual property or sensitive data.
- Phishing & Spoofing: Attackers impersonate trusted entities (banks, IT support, cloud providers) to trick users into revealing credentials or approving fraudulent actions. Example: Fake DNS responses redirecting users to malicious sites.
- Malware Delivery: AiTM positions allow attackers to inject malware into software updates, documents, or web traffic.
Why AiTM Attacks Are Especially Dangerous
- Bypass MFA: Session hijacking allows attackers to bypass traditional security measures.
- Hard to Detect: Encryption alone doesn't prevent AiTM if attackers control a trusted node.
- Broad Impact: Financial losses, reputational damage, legal penalties, and operational disruption.
Detection & Mitigation Strategies
- Use phishing-resistant MFA – Like FIDO2/WebAuthn (e.g., YubiKeys or device-bound passkeys) that binds the token to the domain, making it useless in a proxy attack.
- Enable Conditional Access Policies – Leverage IP-based risk detection, geolocation policies, device compliance checks, etc.
- Token Binding (Session Protection) – Microsoft and Google now support token binding, which ensures tokens cannot be reused from other devices.
- User Education – Train employees to identify and report suspicious links, even if the login page “looks normal”.
- User Education – Train employees to identify and report suspicious links, even if the login page "looks normal".