A man-in-the-middle (MitM) attack is one in which an attacker places themselves between two parties that believe they are talking directly to each other. NIST describes it as an attack where the adversary intercepts and may alter data traveling between the two sides. Today, the term adversary-in-the-middle is often used as a neutral name for the same idea.

How it works

• On local networks, attackers abuse protocols such as ARP or DNS to redirect traffic through their device.
• Rogue Wi-Fi hotspots trick users into connecting through an attacker-controlled access point.
• Weak or missing encryption lets the attacker read traffic, steal credentials or change content.
• In AiTM phishing, a reverse proxy relays a real login page to capture sessions.

MITRE ATT&CK groups these methods under technique T1557, Adversary-in-the-Middle.

Why it matters for defenders

Interception exposes passwords, session tokens and business data in transit. Encryption with properly checked certificates, such as HTTPS and TLS with HSTS, is the main defense, together with secured networks and phishing-resistant authentication that is tied to the real site. When interception does succeed, the stolen credentials often end up for sale later, so they can also show up in leak monitoring.

Sources: NIST CSRC Glossary: man-in-the-middle attack, MITRE ATT&CK T1557: Adversary-in-the-Middle