Adversary-in-the-Middle (AitM)

Adversary-in-the-middle (AitM, written AiTM by MITRE) is an attack in which the attacker positions itself between two parties, such as a user and a sign-in service, so it can read, alter or replay what passes between them. MITRE ATT&CK catalogs it as T1557.

ATT&CK's sub-techniques cover network positions such as ARP cache poisoning, DHCP spoofing and evil twin Wi-Fi, but in identity security the term now mostly means AitM phishing: a reverse proxy such as evilginx2, which MITRE lists under T1557, serves the real login page through the attacker's domain, relays the password and MFA challenge to the genuine service, and keeps the session cookie that comes back. Because the user completes a real sign-in, one-time codes, push approvals and number matching all pass straight through, and the captured session survives a password change until it is revoked. In October 2026 Cisco Talos described UAT-11985 relaying Google passwords and MFA challenges from Taiwan research affiliates lured with fake event invitations. The control that breaks the relay is phishing-resistant MFA, because a passkey or security key will not sign for the proxy's origin, backed by session revocation after any suspected exposure.

See also: AitM phishing proxy, session cookie theft, session hijacking, browser-in-the-browser, Device Bound Session Credentials