Overview
Adversary-in-the-Middle (AiTM) phishing attacks have emerged as the primary technique for bypassing multi-factor authentication in targeted campaigns. Unlike traditional credential phishing, AiTM attacks proxy the victim's real authentication session in real-time, capturing authenticated session cookies that can be replayed without knowledge of the MFA secret.
How AiTM Phishing Works
- Victim receives phishing link pointing to attacker's reverse proxy (Evilginx3, Modlishka)
- Attacker's proxy forwards all traffic to the legitimate site — victim sees a pixel-perfect copy
- Victim authenticates normally, including completing MFA
- Proxy intercepts the authenticated session cookie returned by the legitimate site
- Attacker uses the captured cookie to access the account — MFA challenge is not presented again
Affected Authentication Methods
| MFA Type | Vulnerable to AiTM? |
|---|---|
| SMS OTP | Yes |
| TOTP (Google Authenticator) | Yes |
| Push notification (Duo, Okta) | Yes |
| Email OTP | Yes |
| FIDO2/WebAuthn hardware key | No — origin binding prevents replay |
| Passkeys | No — phishing-resistant by design |
Threat Actor Usage
AiTM kits are now commoditised and available for purchase on criminal forums for $200–$500/month. Campaigns have been observed targeting: - Microsoft 365 and Google Workspace credentials - Banking and financial services portals - Corporate VPN and remote access portals
Recommended Defences
- Deploy phishing-resistant MFA: FIDO2 hardware keys (YubiKey, Google Titan) or passkeys are immune to AiTM attacks.
- Conditional Access policies: Enforce device compliance checks that session cookies cannot satisfy alone.
- Token binding: Where supported, bind session tokens to the client's TLS connection.
- Anomalous session detection: Alert on session token use from geographically impossible locations.
- User training: Ensure users understand that MFA does not guarantee protection against phishing.
Source: ThreatPulse intelligence synthesis from 20 years of historical threat data.