What Is a Man-in-the-Middle Attack?
Man-in-the-middle attacks intercept communications between two parties. Learn how MitM works and the AiTM phishing technique that bypasses MFA.
MitM Attack Types
ARP Spoofing
On local area networks, ARP (Address Resolution Protocol) spoofing sends falsified ARP messages that associate the attacker's MAC address with the IP address of another host, redirecting traffic through the attacker's system. Once positioned as the network gateway, the attacker can intercept, read, and modify all traffic between local hosts and external destinations.
SSL Stripping
SSL stripping downgrades HTTPS connections to HTTP by intercepting the initial HTTP request before it redirects to HTTPS, serving the victim an unencrypted connection while maintaining an encrypted connection to the legitimate server. From the victim's perspective, they are browsing normally; from the attacker's perspective, all traffic is visible in plaintext. HTTP Strict Transport Security (HSTS) headers defend against SSL stripping by instructing browsers to always connect using HTTPS.
Adversary-in-the-Middle Phishing
The most consequential modern MitM variant is AiTM phishing, which proxies authentication to cloud services in real time to capture session tokens after MFA completion. This technique has bypassed MFA at MGM, Caesars, Twilio, Uber, and hundreds of other organizations by sitting between the victim and the legitimate service during authentication.
Public Wi-Fi and Rogue Access Points
Public Wi-Fi networks — coffee shops, airports, hotels — are the most accessible environment for MitM attacks because network participants are anonymous and the infrastructure is not controlled by a trusted organization. Rogue access points with names similar to legitimate networks can capture connections from victims who connect thinking they are on a legitimate network. SSL stripping and traffic inspection can reveal unencrypted communications from connected devices.
Corporate policy requiring VPN use on any non-corporate network provides meaningful protection against public Wi-Fi MitM by encrypting all traffic before it leaves the device, preventing any network-level interceptor from reading communications content.
Defending Against MitM
Encryption is the primary defense: HTTPS with HSTS prevents SSL stripping; VPNs protect traffic on untrusted networks; certificate pinning prevents certificate substitution attacks. Certificate transparency monitoring detects fraudulent certificates issued for organizational domains that could enable MitM with apparently valid certificates. Network monitoring for ARP anomalies detects local network ARP spoofing attacks. Phishing-resistant MFA — FIDO2 — prevents session token capture even when AiTM phishing successfully proxies authentication by cryptographically binding credentials to the legitimate domain.
Related Reading
What is a man-in-the-middle attack?
A man-in-the-middle (MitM) attack is a cyberattack where an adversary secretly intercepts and potentially alters communications between two parties who believe they are communicating directly with each other. The attacker positions themselves in the communication path, receiving all traffic, potentially modifying it, and forwarding it to the intended recipient without either party realizing a third party is present. MitM attacks are the technical foundation for ARP spoofing, SSL stripping, and the adversary-in-the-middle phishing attacks that bypass MFA.
What's the difference between MitM and AiTM (adversary-in-the-middle)?
MitM is the broader category of attacks that position an attacker between two communicating parties. AiTM (adversary-in-the-middle) is a specific modern variant focused on proxying authentication to cloud services in real time to capture session tokens after MFA completion. AiTM is the technique that has bypassed MFA at MGM, Caesars, Twilio, Uber, and hundreds of other organizations. The MFA-bypass capability is what makes AiTM particularly consequential — it defeats the control most organizations rely on for credential protection.
How does ARP spoofing work?
On local area networks, ARP (Address Resolution Protocol) spoofing sends falsified ARP messages that associate the attacker's MAC address with the IP address of another host — typically the network gateway. Other hosts on the network then send their traffic to the attacker's system, believing they are sending it to the gateway. The attacker reads, potentially modifies, and forwards the traffic. ARP spoofing requires the attacker to have local network access (physical, Wi-Fi, or VPN). Tools like Ettercap, Bettercap, and arpspoof automate the technique. Detection through ARP anomaly monitoring is feasible but uncommon in mid-market environments.
What is SSL stripping and how does it work?
SSL stripping downgrades HTTPS connections to HTTP by intercepting the initial HTTP request before it redirects to HTTPS. The attacker serves the victim an unencrypted connection while maintaining an encrypted connection to the legitimate server. From the victim's perspective, they are browsing normally; from the attacker's perspective, all traffic is visible in plaintext including credentials and session cookies. HTTP Strict Transport Security (HSTS) headers defend against SSL stripping by instructing browsers to always connect using HTTPS, even when an HTTP link is clicked or typed.
Are public Wi-Fi networks really dangerous?
Public Wi-Fi networks — coffee shops, airports, hotels — are the most accessible environment for MitM attacks because network participants are anonymous and infrastructure is not controlled by a trusted organization. Rogue access points with names similar to legitimate networks can capture connections from victims who connect thinking they are on a legitimate network. The defensive answer is corporate policy requiring VPN use on any non-corporate network, encrypting all traffic before it leaves the device. With VPN enabled, public Wi-Fi MitM is largely neutralized.
How does phishing-resistant MFA defend against AiTM?
Standard MFA methods — SMS codes, authenticator apps, push notifications — are vulnerable to AiTM because they verify the user has the second factor but do not cryptographically bind the authentication to the legitimate destination. AiTM proxies capture the authenticated session token. Phishing-resistant MFA — FIDO2, WebAuthn, hardware security keys, passkeys — cryptographically binds credentials to the legitimate domain. When AiTM proxies authentication, the cryptographic binding fails because the attacker's proxy domain is not the legitimate domain. This is the single most impactful defense against AiTM and is recommended for all privileged accounts.
What is the most important defense against MitM attacks?
Phishing-resistant MFA (FIDO2/WebAuthn) for privileged accounts, plus HTTPS-everywhere with HSTS for web traffic, plus VPN policy for untrusted networks. These three controls address the major MitM attack categories. AiTM is the most consequential current MitM variant, and FIDO2 is the only widely-available control that defeats it. Organizations with privileged access (administrators, executives, finance) on legacy MFA methods (SMS, authenticator apps) carry meaningful AiTM risk that phishing-resistant MFA migration addresses directly.
Real-World Example: AiTM Phishing Bypasses MFA at Scale
Microsoft's threat intelligence team documented a large-scale AiTM phishing campaign in 2022 that targeted over 10,000 organizations. The campaign used Evilginx2, an open-source adversary-in-the-middle framework, to proxy Microsoft 365 authentication in real time. Victims received convincing phishing emails, clicked to a page that proxied their actual Microsoft 365 login session, completed MFA as normal, and had their session tokens captured. Attackers then used the captured tokens to access victim email accounts to launch BEC attacks from legitimate accounts.
Of enterprise network traffic is not encrypted at the application layer, even in 2026 — creating interception opportunities for man-in-the-middle attackers operating on the same network segments as their targets.