What is AiTM?

Definition of AiTM

AiTM (Adversary-in-the-Middle, attacker in the middle) is an attack in which the criminal sets up a proxy server between the victim and the real login page. The victim enters their data on a realistic-looking page, and the attacker forwards it to the real service — intercepting along the way not only the password, but above all the session token generated after successful authentication.

Why does AiTM bypass MFA?

Classic multi-factor authentication (MFA based on SMS codes, an app, or push) confirms identity at the moment of login. AiTM does not break MFA itself — it steals the already-authenticated session (cookie/token), so the attacker enters the account “behind” the MFA barrier, without needing to confirm again.

How does an AiTM attack proceed?

1. The victim clicks a phishing link (often from quishing or BEC).
2. They land on a proxy page, deceptively similar to the real one.
3. They log in and pass MFA — everything works “normally”.
4. The attacker intercepts the session token and takes over the account.

How to defend against AiTM?

• Deploy phishing-resistant MFA — FIDO2/WebAuthn hardware keys, which bind the login to a specific domain and cannot be proxied.
• Apply conditional access policies (device compliance, location, session risk).
• Monitor session anomalies (unusual IPs, geolocation, parallel sessions) in the SOC.
• Shorten the token lifetime and enforce re-authentication for sensitive operations.

Related terms

• Phishing — the entry vector for an AiTM attack
• Quishing — phishing via QR codes
• BEC — business email compromise

Explore our services

• SOC 24/7 — detection of session hijacking and login anomalies
• Penetration testing — including social engineering simulations and MFA bypass scenarios

AiTM shows that simply enabling MFA is not enough — against modern attacks, what counts is phishing-resistant MFA and session monitoring.