Man-in-the-middle attacks have been a networking concept for decades. The modern version, adversary-in-the-middle phishing, does not intercept traffic on a wire. It sits between the victim and a real login page, captures the session token after MFA completes, and the whole thing starts with a page that looks exactly like a brand the victim trusts.
The term man-in-the-middle describes any attack where an adversary inserts themselves between two parties who believe they are communicating directly with each other. In its original form, this meant intercepting network traffic: a compromised router, a rogue WiFi access point, or a DNS poisoning attack that redirected a connection through an attacker-controlled server. The attacker could read, modify, or inject data into the conversation without either party knowing the communication had been tampered with.
That model still exists, but it is no longer where the most damaging man-in-the-middle attacks occur. The modern variant, known as adversary-in-the-middle or AiTM phishing, operates at the application layer rather than the network layer. Microsoft reported a 146% increase in AiTM attacks in 2024, and by 2025, CrowdStrike’s Global Threat Report found that 82% of all detections were malware-free, with identity abuse replacing technical exploitation as the primary intrusion method. PwC’s 2026 threat assessment summarized the shift: adversaries are logging in rather than breaking in.
How the modern attack works
Traditional man-in-the-middle attacks intercepted data in transit. AiTM phishing intercepts the authentication process itself.
The attacker deploys a reverse proxy server that sits between the victim and a legitimate identity provider, most commonly Microsoft 365, Google Workspace, or Okta. When the victim clicks a link in a phishing email or smishing message, they arrive at a page that appears to be their organization’s login portal. It looks correct because it effectively is: the reverse proxy relays the real login page from the real identity provider, with the attacker’s server passing traffic in both directions. The victim enters their username and password. The proxy forwards them to the real service. The MFA challenge arrives. The victim completes it. Authentication succeeds, and the identity provider issues a session token proving the user’s identity has been verified.
The attacker captures that token. With it, they can load the authenticated session into their own browser and access every application the victim has access to, including email, files, Teams, SharePoint, and any SSO-linked service, without triggering another MFA prompt. Sekoia’s research identified 11 distinct AiTM phishing kits in active commercial operation between January and April 2025, with Tycoon 2FA leading the field. Microsoft Defender for Office 365 blocked more than 13 million malicious emails tied to Tycoon 2FA campaigns in a single month. Obsidian Security reported that MFA failed to prevent the attack in 84% of the incident response cases it handled, a statistic that reflects not a failure of MFA itself but a fundamental limitation: MFA verifies the user’s identity, while AiTM steals the proof that the verification occurred.
These kits are now available to anyone willing to pay. Phishing-as-a-service platforms offer fully configured AiTM kits for $100 to $1,000 per month, complete with domain registration, hosting, template libraries, and real-time dashboards. A single campaign using one of these kits hit 35,000 users across 26 countries in three days.
Why every AiTM attack starts with brand impersonation
BlackFile’s focus on retail and hospitality is not incidental. The sectors share characteristics that make the vishing entry point particularly effective.
Distributed workforces with high helpdesk interaction rates mean that front-line employees are accustomed to receiving calls from central IT about system updates, credential resets, and connectivity issues. A retail associate who regularly interacts with IT support has little basis to distinguish a legitimate call from a spoofed one, particularly when the caller references real systems and current procedures. The volume of legitimate helpdesk interactions creates a baseline of trust that the attacker exploits, and the distributed nature of the workforce means the caller and the employee will never be in the same building.
These organizations also maintain large Salesforce CRM deployments containing exactly the data BlackFile targets: millions of customer records, employee PII, payment information, and confidential business documents. The combination of an accessible entry point and a high-value exfiltration target makes the sector an efficient choice for a group whose operational model depends on speed. CrowdStrike’s analysis emphasized that both Cordial Spider and Snarky Spider operate at unusual speed, moving from initial access to data exfiltration within hours rather than days, and the SaaS-native approach means they rarely touch the endpoint infrastructure where traditional detection tools operate.
How to defend against man-in-the-middle attacks
Defense against AiTM requires controls at both the authentication layer and the brand protection layer because the attack exploits both simultaneously.
Phishing-resistant MFA (FIDO2/WebAuthn, passkeys, certificate-based authentication) is the authentication control that defeats AiTM by design. These methods cryptographically bind the authentication to the legitimate domain, meaning the reverse proxy cannot relay the challenge because the credential will not work on a domain that does not match the one it was registered to. The Canadian Centre for Cyber Security observed that full-session compromises dropped from approximately 20% to 6-7% in tenants that adopted phishing-resistant MFA combined with registered-device conditional access policies. For any organization still relying on push notifications, SMS codes, or authenticator app tokens, this is the most important upgrade available. It is the primary defense against the dominant phishing technique of 2025 and 2026.
For the brands being impersonated in AiTM lure pages, the defense starts before the victim ever reaches the login page. Monitoring for newly registered domains that incorporate your brand name, tracking the infrastructure patterns that connect individual lure domains to broader campaigns, and initiating takedowns before the domains are used in active attacks all reduce the likelihood that your brand’s login page is the interface through which the next session token is stolen. The registration patterns are often predictable: day-old domains, Let’s Encrypt certificates with wildcard SANs, Cloudflare fronting, and brand strings embedded in the hostname are the recurring signatures documented across multiple campaigns this year.
The Bottom Line
Man-in-the-middle attacks have evolved from network-level traffic interception into application-layer session theft that renders standard MFA ineffective. The modern variant, AiTM phishing, is commoditized through phishing-as-a-service platforms, accounts for the majority of MFA bypass incidents in current threat data, and begins, in every documented case, with a page that impersonates a brand the victim trusts. For organizations defending their authentication infrastructure, phishing-resistant MFA is the essential countermeasure. For organizations whose brands appear in AiTM phishing kits, monitoring for and disrupting the lure infrastructure before campaigns launch is the earliest available intervention in an attack chain that moves from phishing message to full account compromise in minutes.
Key Takeaways
An attack where an adversary inserts themselves between two communicating parties. The traditional version intercepted network traffic. The modern version, adversary-in-the-middle (AiTM) phishing, uses a reverse proxy to intercept authentication, capturing session tokens after MFA completes and giving the attacker full access to the victim’s accounts.
The reverse proxy relays the real login page from the legitimate identity provider. The victim authenticates normally and completes MFA. The attacker captures the session token that proves authentication succeeded. With that token, the attacker accesses every application the victim has access to without triggering another MFA prompt.
Microsoft reported a 146% increase in AiTM attacks in 2024. Sekoia identified 11 distinct AiTM kits in commercial operation by early 2025. Obsidian Security found MFA failed to prevent the attack in 84% of incident response cases. A single AiTM campaign hit 35,000 users across 26 countries in three days.
Every AiTM attack begins with a lure page that replicates a trusted brand’s login portal. The reverse proxy works because the victim trusts the page enough to enter credentials. The lure domain is the earliest visible artifact in the attack chain and is detectable through brand monitoring before the phishing message is sent.
Phishing-resistant MFA (FIDO2/WebAuthn, passkeys) defeats AiTM by cryptographically binding authentication to the legitimate domain. For brands being impersonated, monitoring for newly registered domains incorporating your brand name and disrupting lure infrastructure before campaigns launch is the upstream defense.
