Adversary-in-the-middle (AiTM) phishing is a phishing method in which the attacker places a proxy server between the victim and a real login page. The victim sees the genuine site and completes the normal sign-in, including MFA. Meanwhile, the proxy captures the password and the session cookie that the site issues after login.

How it works

• The victim receives a link to a lookalike domain that runs a reverse proxy.
• The proxy forwards every request to the real service and passes the real pages back.
• The user enters their password and MFA code, which the real service accepts.
• The proxy keeps the session cookie, which the attacker replays to log in as the user.

MITRE ATT&CK covers the general technique as T1557, Adversary-in-the-Middle, and notes under T1539 that malicious proxies are used in phishing campaigns to gather session cookies.

Why it matters for defenders

AiTM phishing defeats one-time codes and push approvals, which is why phishing-resistant MFA such as FIDO security keys or passkeys is recommended. Short session lifetimes and alerts on sign-ins from new locations reduce the damage, and stolen cookies enable session hijacking. The attack needs a convincing domain, so watching for lookalike and phishing domains gives a chance to block it before the campaign starts.

Sources: MITRE ATT&CK T1557: Adversary-in-the-Middle, MITRE ATT&CK T1539: Steal Web Session Cookie