You click a link, sign in, approve the multi-factor authentication prompt, and get on with your day. Completely unaware that someone else just logged into your account at the same moment.
This is how Adversary-in-the-Middle (AiTM) phishing attacks work: rather than stealing passwords for later use, these attacks silently hijack an already-authenticated session in real time.
Phishing Has Moved Beyond Passwords
Phishing remains the most common starting point for account compromise, but the objective has changed. While traditional phishing collected usernames and passwords, current phishing is after something more immediately useful: the authenticated session itself.
Security researchers have documented a significant shift toward session and token theft, where attackers intercept the authentication process as it happens.
Rather than reusing stolen credentials, which MFA typically blocks, they wait until the user successfully completes login, then steal the session token that proves it already occurred.
The technique has matured quickly. Even low-skilled attackers can purchase toolkits to run these campaigns targeting Microsoft 365 and Google Workspace.
How AiTM Attacks Work
The fake login page that isn’t fake
An AiTM phishing site behaves exactly like the real service, with correct branding, working redirects, and a functioning MFA prompt. But every keystroke flows through the attacker’s system instead. In most cases, the only clue is a slightly altered URL that goes unnoticed on a mobile screen or when someone is under time pressure.
Why MFA doesn’t stop it
This is where many security assumptions fall apart. MFA protects the moment of authentication, not what comes after it.
Once a user successfully completes MFA, the service issues a session cookie. What this means is that the cookie signals to the application that the user is already verified. From that point, no password or MFA prompt is required. The system trusts the token. Whoever holds the cookie holds the access.
AiTM attacks simply wait for that cookie to be issued then steal it.
Microsoft tracked a 146% rise in AiTM attacks over the past year, as cybercriminals increasingly shift focus to accounts already protected by MFA.
Reducing Your Exposure
MFA is still essential. Building strong authentication practices remains the starting baseline. But reducing AiTM risk requires controls that extend beyond the login event itself.
- Use Authenticators like Microsoft Authenticator
With authenticator apps, not only does the key change every 30-60 seconds, but the key remains local to your phone. Thus it cannot be accessed by another user simultaneously, preventing Adversary-in-the-Middle Attacks. - Train users on URL awareness
Employees who understand that a working MFA prompt on an unfamiliar-looking page still represents a risk are better positioned to pause, check the URL, and report before a session is compromised. A brief team walkthrough of what AiTM lures look like in Microsoft 365 contexts can meaningfully reduce exposure. - Tighten Conditional Access policies
Detecting AiTM compromise typically means watching for activity after login: new MFA method registrations, inbox rules created outside business hours, access from unfamiliar locations, or unusual data activity. Authentication logs alone will not reveal the problem.
- Stop Protecting Just the Login Screen
Multi-factor authentication is a baseline, not a finish line. The businesses that reduce AiTM risk build controls around each layer, not just the login screen.
Want to review your identity security controls? Contact ASIS or schedule a consultation to identify the gaps that matter most before an incident does it for you.
Article used with permission from The Technology Press.