Quick answer: AiTM (Adversary-in-the-Middle) phishing is an attack that steals both the password and the session cookie by using a proxy that sits between the victim and the real login page. Its difference from classic phishing is that it bypasses multi factor authentication (MFA): while the victim enters their code on the real site, the attacker sits in the middle and captures the resulting session cookie. This hijacks the MFA completed session. Defense rests on phishing resistant MFA (passkey/FIDO2) and conditional access.

How does AiTM phishing work?

Classic phishing shows a fake login page and collects the password. But if MFA is enabled, the password alone is not enough. AiTM overcomes this barrier by placing a proxy server in the middle. The victim connects to the attacker's proxy; the proxy forwards requests to the real site. The victim enters the MFA code on the real site, login succeeds, and the real site issues a session cookie. Because the attacker is right in the middle, they capture this cookie.

The result is critical: even without knowing the password, the attacker enters the MFA completed account with the stolen session cookie. So the assumption "I have MFA, I am safe" is insufficient against AiTM.

Classic phishing versus AiTM

Feature Classic phishing AiTM phishing
Target Password Password + session cookie
MFA Creates a barrier Is bypassed
Method Fake page Proxy to the real site
Result Password stolen Session hijacked

Which MFA is resistant to AiTM?

Not all MFA types are equal. An SMS code, an authenticator app and push approval can be bypassed with AiTM, because when the victim enters the code on the real site the attacker captures the session. In contrast, passkeys and FIDO2 security keys are phishing resistant: they are cryptographically bound to the real domain and do not work on a fake proxy domain. So the strongest defense against AiTM is moving to phishing resistant MFA (passkey/FIDO2).

Layers of defense

  1. Use phishing resistant MFA (passkey, FIDO2 security key).
  2. Apply conditional access: managed device, known location and risky session termination.
  3. Set up anomalous session monitoring (ITDR) to detect a stolen session cookie early.
  4. Train staff against the AiTM scenario with up to date phishing simulations.
  5. Shorten session lifetime and require re-authentication for critical operations.

The KAOS and DSET approach

DSET runs authorized phishing simulations that include AiTM scenarios and measures staff resilience against this modern attack. On the email security side we audit SPF, DKIM and DMARC configuration. Our KAOS security engine reports weaknesses in the exposed authentication surface. Our goal is not fear but showing whether MFA is genuinely phishing resistant.

Related reading: infostealer and session cookie theft, password, 2FA and passkey security, phishing and social engineering simulation, ITDR identity threat detection, corporate email security SPF DKIM DMARC, MITRE ATT&CK framework.

Frequently asked questions

Does AiTM phishing really bypass MFA? Yes, but it does not crack MFA. It places a proxy between the victim and the real site; while the victim enters the MFA code on the real site, the attacker captures the resulting session cookie. So even without knowing the password, they enter the MFA completed session. That is why SMS or authenticator based MFA alone is insufficient against AiTM.

Which MFA is safe against AiTM? Passkeys and FIDO2 security keys are phishing resistant because they are cryptographically bound to the real domain and do not work on the attacker's fake proxy domain. SMS, authenticator apps and push approval can be bypassed with AiTM. The strongest defense is moving to passkey/FIDO2.

How do I detect an AiTM attack? Often the user does not notice, because it looks like they logged in on the real site. On the organization side, anomalous session monitoring (ITDR) can catch sessions from unfamiliar locations or devices and access made with a stolen cookie. Session monitoring and conditional access are needed for early detection.

Sources

For an AiTM scenario phishing simulation for your organization, you can talk to our team at Ankara Hacettepe Technopark. Contact DSET.