What to Know About Adversary-in-the-Middle (AiTM) Attacks in 2026

  • min read

An Overview of Adversary-in-the-Middle (AiTM) Attacks

.Adversary-in-the-middle (AiTM) attacks are yet another example of cybercriminals continually finding ways around conventional cybersecurity defenses. Designed to bypass passwords and multifactor authentication (MFA) security protocols, AiTM attacks intercept authentication in real time, granting cybercriminals access to business accounts without necessarily cracking passwords or directly defeating every authentication control.

For businesses that depend on secure cloud platforms, remote access, and digital collaboration, understanding AiTM attacks is essential to protecting sensitive information, financial assets, and customer trust. So, how do AiTM attacks work, and what can your organization do to prevent them?

What is an Adversary-in-the-Middle (AiTM) Attack?

An adversary-in-the-middle attack occurs when a cybercriminal positions themselves between two communicating parties to intercept, monitor, or manipulate their communications.

The broader AiTM technique is recognized in MITRE ATT&CK under technique T1557 (1). In contemporary identity-focused attacks, cybercriminals frequently use malicious proxy websites to relay authentication traffic between victims and legitimate services. This enables them to capture credentials and, potentially, authenticated session cookies or access tokens.

Unlike traditional credential phishing, which typically collects login details through a fraudulent page, an AiTM phishing proxy can interact with the genuine service in real time. The victim may see a legitimate authentication flow and complete MFA, while the attacker captures the resulting authenticated session.

How Do Adversary-in-the-Middle (AiTM) Attacks Work?

A typical AiTM attack unfolds in the following steps:
  • The attacker delivers a phishing lure: The victim receives an email or message containing a link to a fraudulent login page. Common lures include shared documents, voicemail notifications, password-expiration alerts, and urgent HR communications.
  • The victim visits a malicious proxy: The phishing website sits between the victim and the legitimate service, relaying requests and responses rather than simply displaying a static fake login form.
  • The victim authenticates: The user enters their credentials and completes the requested MFA step. The legitimate service may successfully authenticate the user.
  • The attacker captures the session: Depending on the attack and authentication flow, the malicious intermediary can capture an authenticated session cookie or token.
  • The attacker accesses the account: The attacker may reuse the stolen session to access the victim’s account and pursue additional objectives, including data theft, fraudulent payments, and business email compromise.

A critical point: MFA may have worked exactly as designed. The attacker exploits the authenticated session created after verification, rather than necessarily defeating the authentication factor itself.

Why Are Adversary-in-the-Middle Attacks a Serious Threat in 2026?

Several developments make AiTM attacks particularly relevant to modern organizations:

  • MFA Bypass Through Session Theft
    MFA significantly improves account security, but not every MFA method resists real-time phishing. Attackers can relay authentication requests and capture sessions after users complete conventional MFA challenges. This does not mean MFA is ineffective. It means organizations must distinguish between MFA, which adds another verification step, and authentication, which cryptographically binds verification to the legitimate website.
  • Phishing-as-a-Service Lowers the Barrier to Entry
    PhaaS platforms provide cybercriminals with ready-made phishing infrastructure, templates, and other capabilities. Some support AiTM techniques, enabling attackers with limited technical expertise to conduct sophisticated credential and session theft campaigns. Microsoft’s January 2026 research (2) documented phishing campaigns involving platforms such as Tycoon2FA, illustrating how these capabilities can support large-scale credential theft and subsequent business email compromise.
  • Trusted Collaboration Platforms Can Become Attack Vectors
    Attackers may exploit familiar file-sharing workflows, including links to documents hosted on collaboration platforms, to make phishing messages appear credible. In January 2026, Microsoft (3) documented a multistage AiTM and business email compromise campaign that abused SharePoint file-sharing services. Following the account compromise, attackers used trusted identities to distribute additional phishing messages and created inbox rules to help maintain access or evade detection. The lesson is straightforward: a familiar platform or apparently trusted sender does not automatically make a link safe.
  • AI-Themed Lures Add Another Layer of Deception
    Cybercriminals are now leveraging AI tools to make phishing campaigns more effective. Fake AI-product pages, fraudulent sign-in prompts, and impersonation of popular AI brands can encourage users to disclose credentials or approve suspicious authentication requests. In September 2026, Microsoft (4) described campaigns impersonating AI platforms and tools, including a Claude-themed campaign that harvested credentials and access tokens using AiTM techniques.

What Are the Consequences of an Adversary-in-the-Middle Attack?

A successful AiTM attack can extend well beyond a compromised login:

  • Account takeover: Attackers gain access to email, cloud applications, and other business resources.
  • Business email compromise: Criminals impersonate employees, manipulate business conversations, or redirect payments.
  • Data theft: Compromised sessions expose confidential documents, customer information, and intellectual property.
  • Further phishing: Attackers exploit a trusted account to target colleagues, customers, and business partners.
  • Persistence and expanded access: Attackers may create inbox rules, modify account settings, or pursue additional access within the organization.
  • Financial and reputational damage: Fraud, incident response costs, operational disruption, and loss of customer confidence can follow.

How Can Organizations Prevent AiTM Attacks?

While no single control eliminates every AiTM risk, organizations can combine the following practices to mitigate them as far as possible:

1. Implement Phishing-Resistant MFA

Prioritize FIDO2 (Fast Identity Online 2)/WebAuthn-based passkeys or security keys, which use cryptographic authentication tied to the legitimate website’s origin. These mechanisms provide stronger protection against credential-relay phishing than conventional one-time codes or push-based authentication alone.

2. Strengthen Identity and Access Management

Apply least-privilege access, conditional access policies, device-compliance checks, and risk-based sign-in controls. Restrict administrative privileges and require stronger controls for sensitive applications.

3. Improve Email and Web Protection

Deploy effective email filtering, domain-spoofing protections, malicious-link detection, and browser security controls. Configure third-party mail connectors correctly and investigate suspicious messages that appear to originate from internal accounts.

4. Monitor Sessions and Identity Activity

Look for suspicious sign-in patterns, unexpected session reuse, anomalous access locations, and unusual mailbox changes. Correlate identity, email, endpoint, and cloud telemetry to identify attacks that might appear harmless when examined individually.

5. Train Employees to Recognize Phishing

Teach employees to inspect unexpected login requests, verify sensitive requests through trusted channels, and report suspicious messages. Emphasize that a familiar brand, a valid HTTPS connection, or a successful MFA prompt does not automatically establish trust. Consider these 10 best practices for organizations to strengthen employee cybersecurity awareness.

6. Prepare for Rapid Incident Response

If you suspect an AiTM attack, revoke affected sessions and tokens, reset compromised credentials, investigate unauthorized authentication methods and mailbox rules, and assess access to sensitive resources. Review the incident for persistence and further compromise before restoring normal access.

Develop the Expertise to Combat Evolving AiTM Threats

Adversary-in-the-middle attacks expose a fundamental challenge in modern cybersecurity: authenticating a user successfully does not always guarantee that the resulting session remains under that user’s control. As phishing infrastructure becomes more accessible and attackers exploit trusted business workflows, organizations need professionals who can investigate identity-based attacks, implement phishing-resistant controls, and coordinate effective incident response.

In this regard, EC-Council University (ECCU) offers online cybersecurity degrees and certification courses designed to help professionals build the technical knowledge and strategic capabilities in areas such as security operations, digital forensics, incident management, cloud security, and cybersecurity leadership. Whether you want to strengthen your organization’s defenses or advance your cybersecurity career, ECCU can empower you with the expertise to confront threats such as AiTM attacks and contribute to a more resilient digital environment.

Talk to our advisors to discover your next step in advanced cybersecurity education:

Speak to an ECCU Advisor

Frequently Asked Questions

AiTM stands for adversary-in-the-middle. It describes an attack in which a cybercriminal positions themselves between communicating parties to intercept or manipulate traffic. In modern phishing campaigns, attackers often use malicious proxy websites to capture credentials and authenticated sessions.
Traditional credential phishing typically redirects victims to a fraudulent page that collects their login credentials. An AiTM phishing proxy relays authentication traffic to the legitimate service in real time and may capture session cookies or tokens after the victim completes authentication.
Yes. Some AiTM attacks can bypass conventional MFA by relaying authentication requests and stealing the authenticated session. Phishing-resistant authentication, such as FIDO2/WebAuthn, significantly reduces this risk.
Session hijacking occurs when an attacker obtains and reuses a valid session cookie or token to impersonate an authenticated user. Depending on the service’s security controls, the attacker may gain access without repeating the original login process.
Warning signs include unexpected login links, suspicious authentication requests, unfamiliar sign-ins, unusual session activity, unexpected inbox rules, and messages sent from compromised accounts. However, some attacks leave few obvious signs for the end user, making centralized monitoring essential.
Businesses should implement phishing-resistant MFA, strengthen identity and access management, secure email and collaboration platforms, monitor authentication sessions, train employees, and maintain incident response procedures that include session and token revocation.
They overlap but are not always identical in usage. Man-in-the-middle (MiTM) is a broad term for intercepting communications between parties. AiTM is the term used in MITRE ATT&CK to refer to a related family of attack techniques. In identity-focused security discussions, it often refers to phishing proxy attacks designed to steal credentials or authenticated sessions.
Professionals should develop skills in identity and access management (IAM), phishing-resistant authentication, threat detection, cloud security, digital forensics, and incident response. Advanced cybersecurity education, combined with practical experience and continuous learning, can help professionals strengthen their ability to detect, investigate, and mitigate evolving AiTM threats.
References / Sources:
  1. – MITRE ATT&CK technique T1557
  2. – https://www.microsoft.com/en-us/security/blog/2026/01/06/phishing-actors-exploit-complex-routing-and-misconfigurations-to-spoof-domains/
  3. – https://www.microsoft.com/en-us/security/blog/2026/01/21/multistage-aitm-phishing-bec-campaign-abusing-sharepoint/
  4. – https://www.microsoft.com/en-us/security/blog/2026/09/10/detect-and-disrupt-ai-themed-attacks-with-microsoft-defender/

Share this post

Facebook X-twitter Linkedin Pinterest Whatsapp

Recent Posts

INQUIRE NOW

By clicking the Submit button, I give my consent to the processing of my personal data, including for promotional purposes, as provided in the Privacy Policy, and agree to the Terms.

Related Posts

The Top 5 Physical Cybersecurity Threats Organizations Must Protect Against

Physical Cybersecurity Threats Can Be Just as Damaging as Digital Ones Cybersecurity is often associated with sophisticated malware, ransomware, phishing campaigns, and network intrusions. However,

....

Five Design Decisions That Keep Citizen Data From Walking Out the Door

In my last post, I argue that government databases leak through open side doors. Too many people see too much. Systems connect directly. Whole citizen

....

Why Government Databases Leak, and Why I Stopped Trusting the Perimeter

Every time I walk into a government office, I hand over a piece of myself. My name. My national ID number. My home address, my

....

Is AI Making Business Email Compromise (BEC) More Effective?

When a Convincing Email Becomes a Costly Mistake Imagine a finance director receiving an urgent wire transfer request via email that appears to be from

....

Deepfake Fraud: How AI Voice and Video Clones Are Fooling Businesses, and How to Stop Them

Your CFO calls with an urgent request. The voice is right. The accent is right. Even the little pauses sound familiar. But your CFO never

....

Modern APT Campaigns: AI’s Influence on Advanced Persistent Threats

ATP Campaigns in 2027: More Sophisticated, More Prevalent Advanced Persistent Threat (APT) campaigns remain among the most challenging cybersecurity threats facing organizations. Unlike opportunistic attacks

....

Are you looking to pursue a career in cybersecurity?

Unlock Your Cyber Security Potential at EC-Council University

Inquire for Current Term's Admission
Apply Now

Admission Inquiry

Admission Inquiry