Adversary-in-the-Middle Phishing

Layer 5: Session High risk

How it works

Adversary-in-the-middle, or AiTM, phishing uses a website that sits between the victim and the real sign-in service. When the user enters their password and completes the multi-factor prompt, the proxy passes everything to the genuine service in real time. The user sees a normal login and lands in their account, so nothing seems wrong. The fake page may even display your organization's real logo and background, because it is copied live from the genuine service.

Behind the scenes, the proxy captures the session cookie the service issues after successful sign-in. The attacker loads that cookie into their own browser and is treated as already authenticated, without needing the password or MFA again. Ready-made kits make this technique widely available, and it is a common first step in business email compromise and account takeover. Standard push notifications, text message codes and authenticator app codes can all be relayed this way.

Warning signs

• Sign-in pages reached through an email link rather than a bookmark
• Login page web addresses that are not the expected domain
• Session activity from a new location shortly after you signed in
• New inbox rules or MFA methods appearing after a login
• Being asked to sign in to view a document or voicemail

How to defend against it

• Use phishing-resistant MFA such as passkeys or security keys
• Apply conditional access that requires compliant, managed devices
• Shorten session lifetimes and monitor for token reuse
• Filter email links and block newly registered domains
• Teach users to sign in through bookmarks or apps, not links

If it happens to you

1. Revoke all sessions and refresh tokens for the account
2. Reset the password and review registered MFA methods
3. Remove malicious inbox rules or app consents
4. Investigate any messages sent from the account