Adversary-in-the-Middle (AiTM)

An adversary-in-the-middle (AiTM) attack places a proxy server between the victim and a legitimate login page. The victim sees the real site — live, pixel-perfect, functionally identical — because the proxy is relaying it in real time. Everything the victim types passes through the attacker on its way to the genuine service, and everything the service returns passes back through the attacker. Unlike a static fake login page, an AiTM proxy captures not just the password but the session cookie issued after authentication succeeds.

How it works

The victim follows a phishing link — increasingly delivered via QR code, as covered in our guide to QR code phishing — to a domain controlled by the attacker. A reverse proxy (commercial kits like Evilginx, Tycoon 2FA, and their successors automate this) forwards the login flow to the real identity provider. The victim enters their password, approves the MFA push or enters the one-time code, and lands on the genuine application, often never realizing anything happened. The attacker now holds an authenticated session token and can access the account without knowing or needing the second factor again.

This is why AiTM is the standard answer to "but we have MFA": push notifications, SMS codes, and authenticator apps all verify the user to the service — none of them verify that the page in the middle is legitimate.

How to defend against it

• Deploy phishing-resistant authentication — FIDO2 security keys and passkeys bind the credential cryptographically to the legitimate domain, so a proxy on a lookalike domain gets nothing it can replay. Prioritize admins, finance, and executives.
• Use conditional access to flag sign-ins from unfamiliar infrastructure, and alert on impossible-travel or datacenter-IP sessions.
• Revoke sessions on compromise. Password resets alone do not evict an AiTM attacker — active sessions and refresh tokens must be revoked too.
• Train and test the entry point. The attack still begins with a click. Phishing simulations that include AiTM-style lures teach users to check the domain before authenticating, and identify who needs phishing-resistant factors first.