You click a link, sign in, approve the prompt on your phone, and carry on with your morning. Someone else logged into your account at the same moment, and you never noticed.
That’s how an Adversary-in-the-Middle (AiTM) phishing attack works. It doesn’t steal a password for later use. It hijacks the trusted session that exists after multi-factor authentication has already completed. Microsoft tracked a 146% rise in this kind of attack over the past year. For a firm that thinks MFA has the login screen covered, that figure should give pause.
Phishing has moved past passwords
The objective of phishing has shifted. Old-school phishing collected usernames and passwords. MFA largely closed that route, because a stolen password on its own no longer gets an attacker through the door.
What MFA was never designed to protect is what happens after the login completes. Once a user signs in successfully, the service issues a session cookie. That cookie is what tells Microsoft 365 (or Google, or anything else) that the user is verified for the next few hours. No password prompt, no MFA challenge. Whoever holds the cookie is the user, as far as the application is concerned.
Modern phishing kits go after that cookie. Phishing-as-a-Service platforms like Evilginx package the whole thing up so that even low-skilled attackers can run convincing AiTM campaigns against Microsoft 365 tenants.
How the attack actually works
The fake login page in an AiTM attack isn’t a static replica. It’s a live reverse proxy. The attacker’s infrastructure sits between the user and the real Microsoft sign-in service. Every keystroke and redirect flows through the attacker’s server in real time.
From the user’s perspective, nothing looks wrong. The page behaves exactly like the real one, with correct branding, working redirects, and a functioning MFA prompt. The only clue is usually a slightly altered URL, which is easy to miss on a mobile screen or under time pressure.
When the user enters their password and approves their MFA prompt, the attacker’s proxy forwards both to Microsoft. Microsoft validates them and issues a session cookie back. The proxy captures the cookie. The user sees a normal “signed in” experience. The attacker drops the cookie into their own browser and resumes the session inside a fully trusted, already-verified account.
What happens next is the quiet bit
The aftermath of an AiTM compromise is usually silent, which is what makes it dangerous. The attacker is operating inside a legitimate session. There are no failed MFA attempts and no unusual login alerts. Sign-in logs look normal.
Proofpoint’s research into AiTM follow-on activity shows a consistent pattern. The attacker creates hidden inbox rules to redirect mail. They register an additional MFA method to lock in persistent access. They monitor email threads for finance conversations, supplier bank details, or invoice approvals. The first sign of trouble is often a fraudulent payment.
What actually reduces the risk
MFA still matters. AiTM doesn’t break MFA so much as wait for it to complete and steal what comes next. Reducing the risk means adding controls beyond the login event itself.
Phishing-resistant MFA is the strongest defence. FIDO2 hardware keys, passkeys and Windows Hello for Business bind authentication to the device and to the legitimate domain. A proxy in the middle can’t relay them. The Canadian Centre for Cyber Security analysed over 100 AiTM campaigns targeting Microsoft Entra ID accounts and found that phishing-resistant MFA consistently blocked session theft where push notifications and one-time codes did not.
Conditional Access policies catch what slips past authentication. A policy that requires a compliant or hybrid-joined device makes a stolen session token unusable from an unfamiliar laptop. Detection logic should be watching for the after-login signals: new MFA methods being registered, inbox rules created outside business hours, sign-ins from unexpected locations.
Brief team awareness helps too. The detail worth getting across is that a working MFA prompt on an unfamiliar-looking page is still a risk. The MFA succeeding is not proof the page is genuine.
The takeaway
MFA is a baseline, not a finish line. If your firm relies on password-plus-Authenticator-push as the whole identity story, AiTM is the gap. Phishing-resistant MFA on finance, admin and partner-level accounts is the single most useful upgrade you can make.
If you’d like us to review how MFA is configured in your tenant, we’re happy to take a look.