Adversary-in-the-Middle attacks

Phishing has moved beyond passwords

Traditional phishing collected credentials. Modern phishing targets the authenticated session itself. Security researchers have documented a significant shift towards token theft, driven by Phishing-as-a-Service (PhaaS) platforms like Evilginx. These toolkits allow low-skilled attackers to deploy sophisticated campaigns against Microsoft 365 and Google Workspace at scale.

How AiTM attacks actually work

What happens after a session is stolen

Because the attacker operates inside a legitimate session, the aftermath is incredibly quiet. There are no failed MFA attempts or unusual login alerts in standard sign-in logs.

Proofpoint research shows that once inside, attackers commonly:

• Create hidden inbox rules to redirect mail.
• Register additional MFA methods to secure persistent access.
• Monitor emails for financial conversations.
• Launch internal phishing campaigns against colleagues or finance teams.

Reducing your exposure

Defending against AiTM requires security controls that extend beyond the login screen:

• Adopt Phishing-Resistant MFA: Methods like FIDO2 hardware keys and passkeys bind authentication to a specific device and the legitimate domain. The Canadian Centre for Cyber Security analysed over 100 AiTM campaigns and found that phishing-resistant MFA consistently blocked session theft where standard push notifications and one-time passcodes failed.
• Tighten Conditional Access & Monitoring: Detecting a breach means watching for post-login activity, such as new MFA registrations, inbox rules created out of hours, or access from unfamiliar locations.
• Train Users on URL Awareness: Ensure employees understand that a working MFA prompt on an unfamiliar domain is a major risk. A brief walkthrough of Microsoft 365 context lures can significantly reduce exposure.