Adversary-in-the-Middle (AiTM) attacks are an advanced form of phishing designed to steal active login sessions rather than just usernames and passwords. Even accounts protected with multi-factor authentication (MFA) can be vulnerable if attackers capture authenticated session tokens in real time. Understanding how these attacks work helps businesses strengthen identity security, reduce phishing exposure, and detect suspicious access faster.

You click a link, enter your password, approve the MFA prompt, and carry on with your day — unaware that someone else may have accessed your account at exactly the same time.

That’s the danger of Adversary-in-the-Middle (AiTM) phishing attacks.

Many organisations assume MFA alone is enough to stop account compromise. While MFA is still one of the most important security controls a business can implement, AiTM attacks target something different: the trusted session created after authentication has already succeeded.

Instead of stealing passwords to use later, attackers silently hijack live authenticated sessions in real time.

Phishing Has Evolved Beyond Password Theft

Phishing is still one of the most common causes of account compromise, but modern attackers are no longer focused solely on passwords.

Traditional phishing campaigns aimed to capture usernames and passwords. Today’s attacks often target authenticated sessions instead, because they provide immediate access without needing to bypass MFA later.

Security researchers have seen a major rise in session and token theft attacks, where cybercriminals intercept the login process as it happens. Rather than attempting repeated logins with stolen credentials, attackers simply wait for the user to complete authentication successfully — then steal the session token that proves the login already happened.

The barrier to entry has also dropped significantly. Phishing-as-a-Service (PhaaS) platforms now offer ready-made AiTM toolkits that allow even inexperienced attackers to launch convincing campaigns against platforms like Microsoft 365 and Google Workspace.

💡 MFA is still essential — but businesses also need protections that secure authenticated sessions, not just the login process itself.

How AiTM Attacks Work

The “fake” login page is actually live

An AiTM phishing page is far more sophisticated than a basic copy of a login screen. It works as a live reverse proxy between the user and the genuine authentication service.

When a user enters their credentials, every action is passed through the attacker’s infrastructure in real time. The login page behaves exactly like the legitimate service, including:

• Correct branding
• Genuine redirects
• Real MFA prompts
• Fully working sign-in flows

To the user, nothing appears suspicious.

In many cases, the only visible warning sign is a slightly altered URL — something that is easy to miss on mobile devices or when someone is rushing through their emails.

Why MFA alone doesn’t stop AiTM

This is where many businesses misunderstand how MFA protection works.

MFA secures the authentication step itself, but it does not protect the trusted session that exists afterwards.

Once a user successfully signs in and completes MFA, the service issues a session cookie. This cookie tells the application the user has already been verified, meaning no additional password or MFA prompt is required.

Whoever possesses that session token effectively possesses the account access.

AiTM attacks simply wait for the session cookie to be created, then steal it.

Microsoft reported a 146% increase in AiTM phishing attacks over the past year as attackers increasingly target accounts already protected by MFA. Much of this growth has been driven by PhaaS frameworks like Evilginx, which make large-scale reverse-proxy phishing campaigns easier to launch.

Stolen session cookies enable session replay

Session cookies act as bearer tokens. If an attacker obtains the token, they can import it into their own browser and continue the session immediately.

This is known as a session replay attack.

The attacker does not need to log in themselves. Instead, they inherit the already-authenticated session and operate inside a trusted account without triggering additional authentication checks.

What Happens After a Session Is Compromised

One of the biggest risks with AiTM attacks is how quietly they operate.

Because the attacker is using a legitimate authenticated session:

• There are no failed password attempts
• No suspicious MFA prompts
• No obvious login failures in standard sign-in logs

This makes detection much harder.

Research from Proofpoint found that attackers who gain access through session hijacking commonly:

• Create hidden inbox forwarding rules
• Register additional MFA methods for persistence
• Monitor financial or sensitive email conversations
• Launch phishing attacks internally using the compromised account

By the time the attack is discovered, businesses may already be dealing with fraud, data exposure, or wider compromise across the organisation.

---

How to Reduce Exposure to AiTM Attacks

MFA remains a critical baseline security control. But reducing AiTM risk requires security measures that extend beyond the login screen.

Adopt phishing-resistant MFA

Phishing-resistant authentication methods such as:

• FIDO2 security keys
• Passkeys
• Hardware-backed authentication

help prevent AiTM attacks because authentication is tied directly to the legitimate domain and device.

A reverse proxy cannot successfully relay the authentication request if the domain is not genuine.

The Canadian Centre for Cyber Security reviewed over 100 AiTM campaigns targeting Microsoft Entra ID accounts and found that phishing-resistant MFA consistently blocked attacks that bypassed traditional MFA methods like push notifications and one-time codes.

Strengthen Conditional Access policies

AiTM attacks are often identified through suspicious activity that occurs after login rather than during authentication itself.

Businesses should monitor for:

• New MFA method registrations
• Unusual inbox rule creation
• Sign-ins from unfamiliar locations
• Unexpected data downloads or activity
• Suspicious access outside normal business hours

Strong Conditional Access policies can help reduce attacker movement even if a session is compromised.

Train employees to spot suspicious URLs

User awareness still plays a major role in preventing compromise.

Employees should understand that:

• A working MFA prompt does not automatically mean a page is legitimate
• Slightly unusual URLs can indicate phishing
• Microsoft 365 login pages can still be malicious if accessed through the wrong domain

Short, practical training sessions showing real-world AiTM phishing examples can significantly improve awareness.

Stop Protecting Only the Login Screen

MFA is no longer the finish line for identity security — it’s the starting point.

Businesses that successfully reduce AiTM risk are the ones that understand how authentication sessions, tokens, and trust relationships actually work. They build layered protections around the entire identity process, not just the password prompt.

Want to review your identity security and phishing protections? Our Managed IT Services can help identify gaps, strengthen access controls, and reduce the risk of session hijacking attacks before they become a serious incident.

Article used with permission from The Technology Press.

---