You click a link, sign in, approve the MFA prompt, and continue with your day—completely unaware that someone else may have logged into your account at the exact same moment.
That scenario surprises many businesses, especially those that rely on multi-factor authentication (MFA) to secure cloud accounts. Yet this is precisely how Adversary-in-the-Middle (AiTM) phishing attacks work.
Rather than stealing passwords for future use, these attacks silently hijack authenticated sessions in real time.
MFA remains one of the most important security controls organizations can implement, and deploying it correctly is still a critical first step. However, AiTM attacks exploit something MFA was never designed to protect: the trusted session that exists after authentication has already been completed.
Phishing Has Moved Beyond Passwords
Phishing remains the most common starting point for account compromise, but the attacker’s objective has evolved.
Traditional phishing campaigns focused on stealing usernames and passwords. Modern phishing attacks are often after something even more valuable: the authenticated session itself.
Security researchers have documented a significant increase in session and token theft attacks, where cybercriminals intercept the authentication process as it happens.
Instead of reusing stolen credentials—which MFA can often block—attackers wait until a user successfully completes the login process and then steal the session token that proves authentication has already occurred.
The technique has matured rapidly. Phishing-as-a-Service (PhaaS) platforms now provide ready-made proxy toolkits that allow even low-skilled attackers to launch sophisticated AiTM campaigns targeting platforms like Microsoft 365 and Google Workspace.
How AiTM Attacks Actually Work
The fake login page that isn’t fake
An AiTM phishing site is much more sophisticated than a simple fake login page. It operates as a live reverse proxy.
The attacker’s infrastructure sits between the user and the legitimate authentication service. Every keystroke, redirect, and server response passes through the attacker’s system in real time.
From the user’s perspective, everything appears legitimate. The page displays correct branding, functional redirects, and even a working MFA prompt. In many cases, the only clue is a slightly altered URL that can easily be overlooked, especially on mobile devices or during busy workdays.
Why MFA doesn’t stop it
This is where many common security assumptions break down.
MFA protects the authentication process itself, but it does not protect what happens afterward.
Once a user successfully completes MFA, the service issues a session cookie. This cookie tells the application that the user has already been verified. As long as that session remains active, the system no longer requires a password or MFA prompt.
AiTM attacks simply wait for that session cookie to be issued and then steal it.
Cybercriminals are increasingly targeting accounts protected by MFA because they understand that session theft provides a way around traditional authentication controls.
The growth of tools like Evilginx and other PhaaS platforms has made these attacks easier to execute and scale than ever before.
Session cookies
Session tokens act as bearer credentials. In simple terms, whoever possesses the token gains access to the account.
Once the session cookie is stolen, the attacker imports it into their own browser and immediately resumes the authenticated session.
This technique is known as a session replay attack. The attacker never actually logs in. Instead, they pick up exactly where the legitimate user left off inside a fully trusted session.
What Happens After a Session Is Stolen
The aftermath of an AiTM attack is often quiet, which is one reason these attacks are so dangerous.
Because the attacker is operating within a legitimate authenticated session, there are often no failed MFA attempts or obvious login warnings to alert administrators.
Researchers have found that attackers frequently use stolen sessions to:
- Create hidden inbox forwarding rules
- Register additional MFA methods for persistence
- Monitor email conversations involving payments or sensitive information
- Launch phishing attacks against coworkers and business partners
- Expand access throughout the organization
By the time suspicious activity is discovered, financial fraud, data exposure, or broader compromise may already be underway.
Reducing Your Exposure
MFA remains essential. Strong authentication should continue to serve as the foundation of every organization’s security strategy.
However, reducing AiTM risk requires additional layers of protection that extend beyond the login process.
Adopt phishing-resistant MFA
Phishing-resistant authentication methods such as FIDO2 security keys and passkeys bind authentication directly to both the device and the legitimate website.
If a user attempts to authenticate through a malicious proxy site, the authentication process fails because the domain does not match the legitimate service.
These technologies provide significantly stronger protection against session theft than traditional one-time passcodes or push notifications.
Tighten Conditional Access policies
Organizations should monitor activity that occurs after authentication.
Indicators such as new MFA registrations, unusual inbox rule creation, access from unfamiliar locations, or unexpected data activity can help identify compromised sessions before greater damage occurs.
Authentication logs alone often won’t reveal the problem.
Train users on URL awareness
Employee awareness remains a critical defense.
Users should understand that a legitimate-looking login page and successful MFA prompt do not automatically guarantee safety.
Teaching employees to verify URLs, pause before entering credentials, and report suspicious login experiences can dramatically reduce exposure to AiTM attacks.
Stop Protecting Just the Login Screen
MFA is a baseline—not a finish line.
The organizations best positioned to reduce AiTM risk are the ones that understand how sessions, tokens, and identity trust actually work. They build security controls around every stage of the authentication process, not just the login screen.
By combining phishing-resistant MFA, stronger conditional access policies, session monitoring, and employee awareness training, businesses can significantly reduce their risk of session hijacking attacks.
If you’d like to evaluate your organization’s identity security controls, contact us today. We can help identify gaps, strengthen protections, and build a strategy that addresses today’s evolving threats before attackers have the opportunity to exploit them.
Article used with permission from The Technology Press.