What Is a Man-in-the-Middle (MITM) Attack?
A man-in-the-middle (MITM) attack is a cyberattack in which an adversary secretly positions themselves between two communicating parties, such as a user and a website, to intercept, read, or alter the data traveling between them.
It is an active attack: the adversary can modify or inject traffic and impersonate either party, not merely eavesdrop on the exchange.
How a man in the middle attack works
A MITM attack unfolds in two phases:
- First, the attacker gains a position on the communication path (opens in new tab), either by abusing a network protocol (ARP, DNS, DHCP, or rogue Wi-Fi) or by luring the victim into connecting through attacker-controlled infrastructure.
- Second, the attacker splits the connection (opens in new tab) in two: one leg between the victim and the attacker, one between the attacker and the real service. The attacker now sits in the middle as a proxy that can read, modify, and inject data in transit.
In threat intelligence, frameworks catalogue the technique as Adversary-in-the-Middle (T1557) (opens in new tab), or AiTM, especially the phishing-proxy variant that defeats traditional MFA.
The modern enterprise version is AiTM phishing (opens in new tab). An employee clicks a password-reset lure and lands on a reverse-proxy page identical to the real Microsoft 365 sign-in. The credentials and the MFA challenge pass through to the legitimate identity provider, the login succeeds, and the proxy captures the session cookie (opens in new tab) issued after authentication.
With that cookie, the attacker acts as the authenticated user even though the victim completed MFA.
Why man in the middle attacks are hard to stop
TLS encrypts data in transit, but modern AiTM phishing targets the authentication session instead. An AiTM proxy can operate over valid HTTPS sessions (opens in new tab), so the padlock alone does not tell a victim the page is fraudulent.
Traditional MFA does not close the gap. One-time-passcode authenticators offer no phishing resistance, because manual entry does not bind the code to the specific authentication session (NIST SP 800-63B (opens in new tab)).
A Microsoft 365 campaign that began in September 2021 and reached more than 10,000 organizations used stolen session cookies to enter mailboxes and launch business email compromise. The session-cookie technique (opens in new tab) emerged in response to MFA adoption: "MFA is the reason that threat actors developed the AiTM session cookie theft technique in the first place."
The tooling is now a criminal commodity (opens in new tab). Tycoon 2FA, a phishing-as-a-service kit first observed (opens in new tab) in August 2023, bypassed nearly all common MFA methods (opens in new tab), including SMS codes, one-time passcodes, and push notifications.
Types of man in the middle attacks
MITM techniques span local networks, internet routing, browsers, and identity providers:
- ARP cache poisoning (MITRE T1557.002 (opens in new tab)). Forged ARP replies map the attacker's MAC address to a victim's IP address, routing local-network traffic through the attacker's machine.
- DNS spoofing and cache poisoning. Forged DNS responses poison a resolver's cache (opens in new tab) with attacker-controlled IP addresses. The Sea Turtle (opens in new tab) group modified DNS records at service providers to redirect traffic for credential capture.
- Evil twin Wi-Fi (MITRE T1557.004 (opens in new tab)). A rogue access point broadcasts a legitimate SSID, often at stronger signal, then routes anyone who connects to a fake captive portal that harvests corporate credentials.
- SSL stripping. The attacker intercepts the HTTP-to-HTTPS upgrade (opens in new tab) and holds the session on plain HTTP, exposing cookies and credentials.
- BGP hijacking. False route announcements reroute internet traffic (opens in new tab) at global scale, enabling interception from outside the victim's network.
- AiTM phishing proxies. Kits such as Evilginx and Tycoon 2FA place a reverse proxy between the user and the identity provider to capture post-MFA session cookies.
- Man-in-the-browser. A Trojan intercepts calls (opens in new tab) inside the victim's own browser, so transport encryption stays intact while the transaction on screen is altered.
How to defend against man in the middle attacks
No single control stops MITM, so defenses layer several across the same points attackers exploit:
- Deploy phishing-resistant MFA. In practice that means FIDO/WebAuthn (opens in new tab) authenticators. WebAuthn cryptographically binds (opens in new tab) a passkey to the legitimate site's origin, so a proxy on a lookalike domain fails the exchange. Because attackers will try to force authentication downgrades, retire one-time-passcode fallbacks rather than layering passkeys on top of them.
- Harden transport. Enforce current TLS guidance (opens in new tab) and HTTP Strict Transport Security (opens in new tab) so a session cannot be silently downgraded to plain HTTP.
- Close network positioning paths. Apply DNS security controls (opens in new tab), including DNSSEC validation, and enable Dynamic ARP Inspection and DHCP snooping to block Layer 2 spoofing (opens in new tab).
- Bind sessions to devices. Device-bound controls tie a token to its originating device, so a stolen cookie fails elsewhere, through options such as Microsoft Token Protection (opens in new tab) and Google's Device Bound Session Credentials (opens in new tab). In incident response, revoke session tokens (opens in new tab) and roll back MFA changes; a password reset alone leaves stolen sessions valid.
- Monitor attacker infrastructure externally. AiTM phishing runs on attacker-controlled infrastructure, including lookalike domains.
Track newly registered phishing domains (opens in new tab) that impersonate or target your brand before the first lure goes out.
How Doppel helps
Doppel, the AI-native Social Engineering Defense (SED) platform that unifies Digital Risk Protection and Human Risk Management, works at that external staging layer. It detects the lookalike domains, fraudulent certificates, and hosted proxy login pages that stage AiTM phishing before the first lure reaches an inbox.
The Doppel Threat Graph correlates that staging activity across the open web, dark web, messaging, and social surfaces, tying lookalike domains, fresh certificates, and spoofed sign-in pages to the single campaign behind them. Its agentic AI prioritizes and dismantles that infrastructure with takedowns at scale, while analysts handle the escalations that need human judgment.
Taking those pages down before they collect a credential makes your brand too costly to attack.
Request a demo with Doppel to walk through the detection-to-takedown workflow against live impersonation infrastructure targeting your brand.
Frequently asked questions about man in the middle attacks
What is a man in the middle attack?
A man-in-the-middle (MITM) attack is an attack in which an adversary secretly positions themselves between two communicating parties, such as a user and a website, to intercept, read, or modify the data flowing between them. It is an active attack that lets the adversary alter or inject traffic and impersonate either party. Adversary-in-the-middle (AiTM) is the current threat-intelligence term for the same technique, including within MITRE ATT&CK (opens in new tab).
What is the difference between a man in the middle attack and session hijacking?
A MITM attack intercepts the communication channel (opens in new tab) itself in real time, including during authentication. Session hijacking targets the token (opens in new tab) a service issues after a user has already authenticated: the attacker steals or predicts that token and takes over the established session. An attacker can capture a session token from a MITM position or by other means, such as cross-site scripting.
Does multi-factor authentication stop man in the middle attacks?
Traditional MFA methods such as SMS codes and one-time passcodes do not stop AiTM (opens in new tab) phishing. Push notifications do not stop it either: the attacker's reverse proxy lets the victim complete MFA on the real service, then steals the resulting session cookie. FIDO2 credentials, including passkeys, resist these attacks structurally, because the cryptography binds each credential to the legitimate site's origin and blocks relay through a fake page, provided weaker methods are not left enrolled as a fallback.
What is an example of a man in the middle attack?
Tycoon 2FA is a recent adversary-in-the-middle (AiTM) phishing operation. The phishing-as-a-service kit placed reverse proxies between users and identity providers to capture post-MFA session cookies. In March 2026 (opens in new tab), Europol, Cloudflare, and Microsoft's Digital Crimes Unit seized its domains and backend services.