Adversary-in-the-middle phishing
noun · also AiTM, AiTM phishing · MITRE ATT&CK T1557
Phishing that relays the victim's sign-in to the real site through an attacker's proxy, stealing the session cookie after MFA succeeds.
In an adversary-in-the-middle (AiTM) attack, the phishing page is not a fake copy of the login screen. It is a proxy that sits between the victim and the real identity provider, forwarding everything in both directions. The victim types their password and completes MFA against the genuine service, and the proxy keeps the session cookie that comes back.
With that cookie, the attacker can open the victim's mailbox or apps without knowing the password and without triggering MFA again, until the session expires or is revoked.
Example
A user receives an email about a shared document and clicks the link. The page looks exactly like the Microsoft sign-in, because it is the Microsoft sign-in, relayed through a lookalike domain. The user approves the MFA prompt as usual. Minutes later, a new inbox rule appears in their mailbox, created from an IP address the user has never used.
Why it matters for a SOC analyst
AiTM is why "the user had MFA" does not close an investigation. Look for a sign-in from the user's real location followed closely by activity from an unfamiliar IP with the same session. Revoking sessions is essential here, because resetting the password alone does not invalidate a stolen cookie. Phishing-resistant MFA defeats the technique, because those methods are bound to the real domain.
Articles that use this term
Threat Analysis · · 4 min read
MFA fatigue attacks: how push bombing works and how to stop it
Why attackers flood users with MFA prompts until one gets approved, what the Uber and Cisco breaches teach us, and the controls that make push bombing fail.
Related terms
- Phishing
A message that impersonates someone trustworthy to trick the recipient into clicking a link, opening a file, sharing credentials or sending money.
- Phishing-resistant MFA
Authentication methods, such as passkeys, FIDO2 keys and Windows Hello for Business, that cannot be relayed or approved by a phished user.
- Business email compromise
Fraud in which an attacker impersonates or takes over a trusted business email account to redirect payments or obtain sensitive data.
- MFA fatigue
An attack that floods a user with MFA push prompts, using a stolen password, until the user approves one out of confusion or annoyance.
- Conditional Access
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.