SecurityRingBook a Demo

Glossary

What is adversary-in-the-middle (AiTM) phishing?

Phishing that relays the victim to the real sign-in page through an attacker’s proxy, capturing both the password and the session cookie so the attacker can skip MFA.

How it works

Microsoft explains that in AiTM phishing the attacker places a proxy server between the user and the site they want to visit. Every page is passed through from the real site, so it looks identical, and the attacker captures the password and the session cookie. With the cookie the attacker is signed in, whatever sign-in method the user used. Microsoft notes this is not a vulnerability in MFA, and recommends phishing-resistant MFA and conditional access.

A real example

In July 2022 Microsoft reported an AiTM campaign that attempted to target more than 10,000 organisations since September 2021, in one run starting with an email about a voice message. After stealing session cookies the attackers searched mailboxes for payment threads and began payment fraud, in some cases within five minutes.

How to train for it

  • The URL may be the only visible difference: check it every time.
  • A completed MFA prompt does not make a page safe.
  • Report immediately if you entered details on a page you are unsure of.

SecurityRing’s live credential-harvesting simulations train the address-bar check that catches this lure.

Sources

Every clause, incident and figure above comes from these official or original sources.

  1. Microsoft Threat IntelligenceFrom cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraudPublished 12 July 2022 · Accessed 17 October 2026.