Section 1 · The basics
What is an AiTM attack?
An AiTM attack stands for adversary-in-the-middle attack. It is a phishing technique where an attacker positions a malicious proxy between a user and a legitimate website or application.
Instead of simply stealing a username and password, an AiTM attack can intercept the authentication process in real time. The employee may see what looks like a normal login page. They may enter their password. They may complete MFA. But behind the scenes, the attacker is relaying that login to the real service and capturing the session data.
This is why AiTM attacks are especially dangerous for businesses that rely on traditional MFA but have not reviewed the surrounding security controls. Huntress describes AiTM attacks as attacks that use proxy servers to intercept real-time authentication, capture credentials and session data, and bypass MFA in some scenarios.
In plain English
An AiTM attack tricks an employee into logging in through the attacker’s system, then steals the authenticated session.
That can lead to:
- Microsoft 365 account compromise
- Business email compromise
- Internal phishing from a trusted employee account
- Wire fraud attempts
- Data exposure
- Inbox rule manipulation
- Unauthorized file access
- Vendor or client impersonation
This is not just an IT problem. It is a business risk problem.
Section 2 · The mechanics
How does an AiTM attack work?
Most AiTM attacks follow a simple but dangerous pattern.
The employee receives a convincing message
The attack usually starts with a phishing email, fake document share, Teams message, QR code, or other trusted-looking request. The message may appear to come from Microsoft, a vendor, a coworker, a client, or a file-sharing platform. The message creates urgency:
The goal is to get the user to click.
The link sends the employee to a fake login page
The user lands on what appears to be a normal Microsoft 365, Google, or cloud application login page. But the page is not simply a static fake. In an AiTM attack, the attacker may use a proxy that sits between the user and the real login service.
The user thinks they are logging into the legitimate system. The attacker is watching and relaying the interaction in real time.
The employee enters credentials and completes MFA
The employee enters their username and password. If MFA is required, the employee may also complete an MFA prompt.
This is where many businesses get a false sense of security. They assume that because MFA is turned on, the login is protected. But in some AiTM scenarios, the attacker is not just stealing the password. The attacker is intercepting the authenticated session.
The attacker captures the session token
After authentication is complete, the legitimate service issues a session token. That token tells the application, “This user has already logged in.”
If the attacker captures that token, they may be able to access the account without knowing the password or completing MFA again. Microsoft reported that AiTM phishing kits such as Tycoon2FA enabled attackers to bypass MFA and conduct account compromise at scale.
The attacker uses the account
Once inside the account, the attacker may:
- Read email
- Search for invoices or payment conversations
- Create hidden inbox rules
- Send phishing emails from the compromised account
- Impersonate an executive
- Access SharePoint or OneDrive files
- Attempt wire fraud
- Expand into other accounts
- Target clients or vendors
The damage often happens after the login, not during the login. That is why AiTM prevention requires more than telling employees to “watch for phishing emails.”
Section 3 · The stakes
Why should business owners and executives care about AiTM attacks?
AiTM attacks matter because they expose a dangerous assumption: “We have MFA, so we are protected.”
MFA is still important. Every business should use it. But traditional MFA by itself may not be enough against modern phishing techniques that target authentication sessions instead of only passwords.
For business leaders, the risk is not the technical method alone. The risk is what a compromised account allows an attacker to do. A single compromised Microsoft 365 account can create business consequences such as:
- Fraudulent invoice requests
- Payroll redirection scams
- Client data exposure
- Confidential file access
- Reputational damage
- Regulatory or insurance complications
- Loss of trust with customers and vendors
- Disruption to operations
- Emergency IT and forensic costs
“Do we have MFA?”
“Do we know where our cyber risk gaps are?”
Questions worth asking:
- Are we using phishing-resistant MFA where needed?
- Are conditional access policies configured properly?
- Are suspicious sign-ins being reviewed?
- Can we revoke active sessions quickly?
- Do employees know how these attacks look?
- Are inbox rules and forwarding changes monitored?
- Do we have an incident response process?
- Are executives and finance users protected differently?
- Are third-party and vendor accounts reviewed?
- Are backups and business continuity plans tested?
AiTM attacks are often a symptom of a bigger security maturity problem.
Section 4 · Know the difference
AiTM attack vs traditional phishing vs man-in-the-middle attack
Many people confuse AiTM attacks with traditional phishing or older man-in-the-middle attacks. They are related, but they are not identical.
| Attack type | What happens | Main risk |
|---|---|---|
| Traditional phishing | A user enters credentials into a fake page | Password theft |
| Man-in-the-middle | An attacker intercepts communication between two parties | Data interception or manipulation |
| AiTM attack | An attacker proxies the login session between the user and the real service | Credential theft, MFA bypass, and session token theft |
The important difference is that AiTM attacks can happen even when the user believes they are interacting with a legitimate login process. That is what makes them so dangerous.
A traditional phishing attack often stops at stealing the password. An AiTM attack may go further by stealing the authenticated session.
Section 5 · MFA bypass
Can AiTM attacks bypass MFA?
Yes, some AiTM attacks can bypass traditional MFA by capturing session tokens after the user successfully authenticates.
That does not mean MFA is useless. MFA remains one of the most important baseline security controls. But not all MFA is equally resistant to phishing. Traditional MFA methods may include:
- SMS codes
- Email codes
- Push notifications
- One-time passwords
- Authenticator app approvals
These methods can reduce many risks, but they may still be vulnerable to social engineering, token theft, push fatigue, or proxy-based phishing.
Phishing-resistant MFA is designed to reduce this risk. CISA has emphasized that phishing-resistant MFA is intended to prevent MFA bypass attacks and includes options such as smart cards and FIDO security keys.
“Do we have MFA?”
“Is our MFA strong enough for the accounts, systems, and business risks we need to protect?”
That answer depends on your users, your systems, your industry, your data, your compliance obligations, and your current security configuration.
Not sure if your MFA setup holds up?
Assess your MFA and identity security gaps — along with seven other risk areas — in about 6 minutes.
Section 6 · Where businesses are exposed
Common cyber risk gaps AiTM attacks expose
AiTM attacks rarely succeed because of one single missing tool. They usually expose a stack of small gaps across people, process, and technology. Here are the most common areas to review.
1. Identity & access gaps
Many businesses have MFA turned on but have not fully reviewed how identity is managed.
- MFA is not enforced for every user
- Admin accounts are not protected differently
- Legacy authentication is still allowed
- Conditional access policies are weak or missing
- Risk-based sign-in policies are not configured
- Sessions are not limited or reviewed
- Users can add their own MFA methods without oversight
- Former employees or stale accounts still exist
AiTM attacks target identity. If identity controls are weak, the attack has more room to spread.
2. Email security gaps
AiTM attacks often begin with email or messaging.
- Weak phishing protection
- Poor impersonation detection
- No DMARC, DKIM, or SPF review
- Employees receive too many unfiltered malicious messages
- External sender warnings are missing or ignored
- Suspicious links are not rewritten, scanned, or blocked
- Mailbox forwarding and inbox rules are not monitored
Email is still one of the easiest ways into a business. AiTM attacks make that entry point more dangerous.
3. Microsoft 365 & cloud security gaps
For many businesses, Microsoft 365 is the center of communication, files, identity, and collaboration.
- Sign-in logs are not reviewed
- Risky users are not investigated
- Impossible travel alerts are ignored
- SharePoint and OneDrive permissions are too broad
- Guest access is not governed
- Security defaults or conditional access are misconfigured
- Admin roles are too widely assigned
- Audit logs are not enabled or retained long enough
If a compromised account can access email, files, Teams, SharePoint, and vendor conversations, one login can become a larger business event.
4. Employee behavior gaps
Employees are often trained on obvious phishing emails. AiTM attacks may look more convincing.
- Training is too generic
- Employees are not shown realistic login phishing examples
- Users do not know how to report suspicious messages
- Finance and executive staff do not receive extra training
- Employees approve MFA prompts without thinking
- Users rely on “the page looks real” as their main test
The issue is not that employees are careless. Modern phishing is designed to defeat normal human trust patterns.
5. Monitoring & detection gaps
Many businesses cannot quickly answer basic questions after a suspicious login:
- Who logged in? From where? On what device?
- Was MFA completed? Was a token issued?
- Was email accessed? Were inbox rules created?
- Were files downloaded?
- Were messages sent externally?
- Were additional accounts targeted?
If you cannot detect suspicious account behavior, you may not know an AiTM attack succeeded until fraud or data exposure has already happened.
6. Incident response gaps
AiTM attacks require fast containment.
- No written incident response process
- No clear owner for security incidents
- No process to revoke sessions
- No process to reset MFA methods
- No mailbox investigation checklist
- No communication plan for clients or vendors
- No cyber insurance notification procedure
- No post-incident review process
When an attacker has an active session, speed matters.
7. Backup & business continuity gaps
AiTM attacks may begin with account compromise, but they can create broader disruption.
- Backups are not regularly tested
- Microsoft 365 data backup is misunderstood
- Critical data locations are unknown
- Recovery time expectations are unclear
- Business continuity plans are outdated
- Leadership does not know what happens after a major incident
Not every AiTM attack becomes a ransomware incident, but account compromise can still disrupt operations and expose data.
8. Vendor & third-party risk gaps
Attackers often use compromised accounts to target vendors, customers, or partners.
- Vendor access is not reviewed
- Shared accounts are used
- External guest users are not audited
- Vendor payment changes are not independently verified
- Clients and vendors are not warned quickly after compromise
- No process exists for confirming unusual financial requests
AiTM attacks can turn your business into the trusted sender that attacks someone else.
Which of these gaps apply to your business?
Stop guessing. The 6-minute assessment covers every risk area above and shows you where to start.
Section 7 · What to watch for
Warning signs of an AiTM attack or account compromise
AiTM attacks can be hard to spot in the moment, but there are warning signs businesses should take seriously. Watch for:
- Unexpected MFA prompts
- Logins from unusual locations
- Impossible travel alerts
- Sign-ins from unfamiliar devices
- New inbox rules
- Email forwarding changes
- Sent messages the user did not send
- Deleted security notifications
- Unusual SharePoint or OneDrive activity
- Password reset attempts
- New MFA methods added to an account
- Vendor or client complaints about suspicious emails
- Finance conversations suddenly changing tone or payment instructions
Take it seriously
A user saying “something felt off when I logged in” should be treated seriously.
Section 8 · Respond fast
What should you do if you suspect an AiTM attack?
If you believe an employee account may have been compromised through an AiTM attack, act quickly. A practical response may include:
- Revoke active sessions for the affected user.
- Reset the user’s password.
- Review and reset MFA methods.
- Check sign-in logs.
- Review mailbox rules and forwarding.
- Check sent and deleted items.
- Review file access in SharePoint, OneDrive, or other cloud systems.
- Confirm whether any financial or vendor conversations were accessed.
- Notify internal leadership if business email compromise is possible.
- Contact your IT or cybersecurity provider for deeper investigation.
Do not assume that changing the password alone fixes the problem. If the attacker has an active session token, the account may remain exposed until sessions are revoked and access is fully reviewed.
This is also a good moment to evaluate whether your business has the right preventive and detective controls in place.
Better to know before it happens
Take the 6-minute cyber risk assessment and find out where your defenses and response plans stand today.
Section 9 · The plan
How to reduce your risk from AiTM attacks
No single control eliminates AiTM risk. The goal is to reduce the likelihood of compromise and limit the damage if an account is targeted. Key controls to review include:
Strengthen identity security
- Enforce MFA for all users
- Use phishing-resistant MFA for high-risk accounts
- Disable legacy authentication
- Apply conditional access policies
- Require compliant or trusted devices where appropriate
- Limit admin privileges
- Review stale accounts
- Monitor risky sign-ins
Improve email protection
- Strengthen anti-phishing policies
- Review impersonation protection
- Configure and monitor SPF, DKIM, and DMARC
- Use safe links or link protection where appropriate
- Block known malicious domains
- Monitor forwarding rules and suspicious mailbox changes
Train employees with realistic examples
- Show employees what fake login pages look like
- Teach users not to trust a page only because it looks familiar
- Train staff to report suspicious MFA prompts
- Give finance and executives extra training
- Reinforce verification steps for payment or credential requests
Improve monitoring and response
- Review sign-in logs and risky users
- Monitor mailbox rule changes
- Create an account compromise checklist
- Document who does what during an incident
- Test session revocation procedures
- Review cyber insurance reporting requirements
- Run tabletop exercises for business email compromise scenarios
Review your business risk gaps
The strongest security programs do not rely on a single tool. They identify where the business is most exposed and prioritize fixes based on actual risk.
That is exactly what a cyber risk gap assessment is designed to help you do.
Section 10 · The takeaway
AiTM attacks raise a bigger question than “do we have MFA?”
Many companies have security tools in place but still do not know where they are most exposed.
- They may have MFA but weak conditional access.
- They may have email filtering but no mailbox rule monitoring.
- They may have backups but no tested recovery process.
- They may have employee training but no incident response plan.
- They may have an IT provider but no clear cybersecurity roadmap.
AiTM attacks are a useful wake-up call because they reveal the difference between having security tools and having a mature, layered security posture.
“Are we doing anything for cybersecurity?”
“Where are the gaps that could create the most business risk?”
