Know
What is Adversary-in-the-Middle Phishing?
In AiTM phishing, the victim interacts with an attacker-controlled reverse proxy positioned between the browser and a legitimate service. The proxy relays the real login experience while observing credentials and authentication tokens. Because the victim may successfully complete ordinary MFA, the attacker can obtain an authenticated session without needing to defeat the MFA factor cryptographically.
Why it matters
Microsoft observed large-scale AiTM campaigns in 2026 targeting tens of thousands of users. The technique demonstrates why conventional push, SMS, and OTP MFA can reduce risk without fully stopping modern token-focused phishing.
Evidence, not hype
Validated in the real world
Every record is labeled by evidence type and source strength so an incident, a standard, and emerging research are never presented as if they are the same thing.
Large-scale AiTM phishing targeted more than 35,000 users across 13,000 organizations
Microsoft analyzed a multi-stage phishing campaign observed in April 2026 that targeted more than 35,000 users across more than 13,000 organizations and ultimately used adversary-in-the-middle infrastructure to capture authentication tokens.
This validates that session-token compromise and AiTM phishing are operating at enterprise scale and can bypass non-phishing-resistant MFA even when the user sees a legitimate authentication experience.
Understand the mechanics
How it works
- 1
A phishing lure sends the user to attacker-controlled infrastructure.
- 2
The infrastructure proxies the legitimate login page.
- 3
The victim enters credentials and completes MFA.
- 4
The proxy relays the transaction while capturing session tokens.
- 5
The attacker reuses the token to access the legitimate service.
- 6
Follow-on activity may include mailbox access, data theft, fraud, or persistence.
Practice
What to watch for
- Unexpected login link despite a legitimate-looking sign-in page
- Token use from a different network or device shortly after authentication
- New inbox rules or OAuth activity
- Sign-in risk indicating malicious reverse proxy infrastructure
- Session activity inconsistent with the user
Perform
What to do
- 1
Revoke sessions and refresh tokens, not only the password.
- 2
Reset credentials and re-register strong authentication if compromise is confirmed.
- 3
Review email, SaaS, and cloud activity performed during the token lifetime.
- 4
Block identified phishing infrastructure and hunt for other recipients.
How to reduce the risk
- FIDO2/WebAuthn or passkey-based phishing-resistant MFA
- Conditional access
- Token protection where supported
- Browser and email protections
- Continuous session-risk evaluation
Business impact
- Account takeover despite MFA
- BEC
- Data theft
- SaaS compromise
- Persistence through stolen tokens
What different roles should do
Employee
- Navigate to sensitive services independently rather than through unexpected links
Security
- Correlate phishing telemetry with token and session activity
- Prioritize phishing-resistant authentication
Framework & standards context
- MITRE ATT&CK Credential Access
- MITRE ATT&CK Steal Web Session Cookie
Source transparency
Authoritative sources
Last reviewed: 2026-09-02