AiTM phishing (adversary-in-the-middle)

Adversary-in-the-middle (AiTM) phishing is a technique in which the phishing site sits between the victim and the real service and relays traffic in both directions. The victim logs in to the genuine service through the attacker's proxy, so the attacker captures not only the password but also the session cookie issued after multi-factor authentication. With that cookie, the attacker can use the account without needing the second factor again.

How it works

1. The victim clicks a link to a lookalike domain that runs a reverse proxy.
2. The proxy fetches the real login page and shows it to the victim, so it looks and behaves exactly like the original.
3. The victim enters a password and approves a push notification or types a one-time code; the proxy passes everything to the real service.
4. The real service returns a session cookie, which the proxy copies before handing it on.
5. The attacker imports the cookie into a browser and is signed in as the victim.

Open-source red-team frameworks for this exist, and criminal kits sold as a service have packaged the same approach. Microsoft and other vendors have published research on large AiTM campaigns against business email accounts.

Example

As an illustration, finance staff at a company receive a message about an overdue invoice. The link leads to examplecorp-sso[.]com, which displays the company's real sign-in page, logo and MFA prompt, because it is proxying them live. After approving the MFA prompt, the employee sees the normal inbox. Hours later, a new inbox rule is created and invoices start being redirected, a common path into business email compromise.

How to spot it

• An exact copy of your sign-in page on a domain that is not yours.
• Sign-ins from unfamiliar locations or networks right after a successful MFA approval.
• New mailbox rules, added devices or changed recovery details soon after a login.
• Recently issued TLS certificates for domains containing your brand and words like "sso" or "login".

What brands can do

Phishing-resistant authentication, such as FIDO2 security keys and passkeys, is tied to the real domain and does not complete on a proxy, so it is the strongest defence. Conditional access, token protection and short session lifetimes reduce what a stolen cookie is worth. Externally, the proxy domain has to be taken down quickly at the registrar and host. Phishvoid verifies AiTM pages and files these takedowns; contact us if your login pages are being proxied.

Read more: How to Spot a Phishing Website: 10 Warning Signs