← All Insights
Microsoft 365 5 min read

Adversary-in-the-Middle Attacks: Why MFA Alone Isn't Always Enough

Phishing attacks continue to evolve. Adversary-in-the-middle (AiTM) attacks are especially dangerous because they can intercept credentials and authenticated sessions in real time.

CBITS

In 2023, Microsoft reported a multi-stage AiTM phishing campaign targeting multiple business sectors and exploiting vendor-supplier relationships to commit financial fraud. Attacks like these are an important reminder that enabling MFA is only one part of a modern identity-security strategy.

What is an adversary-in-the-middle attack?

An adversary-in-the-middle attack places an attacker between a user and a legitimate authentication service. Instead of simply collecting a password, the attacker proxies the sign-in process and can intercept credentials and MFA session cookies.

The user may believe they are signing into the legitimate service, but the page they are interacting with is controlled by the attacker.

  1. The user enters their credentials into the phishing site.
  2. The attacker uses those credentials against the intended website.
  3. The real MFA challenge is mirrored back through the phishing site.
  4. The user completes the MFA prompt.
  5. The attacker captures the authenticated session and can impersonate the user.

Why a password reset may not be enough

Responding to an AiTM compromise requires more than changing the user's password. An attacker who has gained account access may add new authentication methods, such as additional phone numbers or one-time-password methods, to create another path back into the account.

That means remediation should include a thorough review of the user's authentication methods and active sessions, not just a password reset.

Security controls that reduce AiTM risk

There is no single setting that replaces a layered security posture. The controls we focus on include:

Conditional Access

  • Restrict sign-ins based on trusted networks and locations where appropriate.
  • Require phishing-resistant, passwordless authentication methods such as passkeys.
  • Reduce reliance on more vulnerable authentication options such as SMS, email OTP, and voice calls.

Anti-phishing protection

  • User and domain impersonation protection.
  • Spoof intelligence.
  • Safety tips for suspicious email patterns.

Attack simulation training

Technical controls are strongest when users also get practice recognizing realistic phishing attempts. Microsoft Defender attack simulations provide a safe way to test those behaviors and reinforce reporting.

Next steps

If your organization is still relying primarily on Microsoft security defaults or traditional MFA methods, it is worth reviewing whether your identity controls are prepared for modern phishing techniques such as AiTM.

The goal is not simply to add another MFA prompt. It is to make stolen credentials and proxied sign-in sessions significantly less useful to an attacker.