What are the signs that an organisation’s identity controls are failing against attacker-in-the-middle phishing?

Common failure signs include successful logins from suspicious domains, repeated MFA prompts, unexpected session use outside managed browsers, and users entering valid passwords into sites that do not belong to the real service. Another warning sign is ghost logins, where multiple authentication paths remain active for one account. Those gaps give attackers room to capture credentials and persist.

Why This Matters for Security Teams

Attacker-in-the-middle phishing is dangerous because it defeats identity controls at the moment they are supposed to add trust. The user may enter a real password, complete MFA, and still hand an attacker a live session token. That means the control failure is not just “someone clicked a bad link.” It is often a signal that authentication, session binding, and browser trust assumptions are too weak for modern phishing. NHIMG’s Ultimate Guide to NHIs shows how identity risk compounds when credentials remain valid too long, and the same pattern appears in human identity attack paths.

Security teams should treat repeated MFA prompts, logins from unfamiliar infrastructure, and sessions that survive beyond expected browser or device context as evidence that the control stack is being actively bypassed. Current guidance suggests that phishing-resistant authentication reduces this exposure, but there is no universal standard for every user population or application yet. The practical question is whether the organisation can still distinguish a legitimate session from an attacker replaying the same flow in real time. In practice, many security teams only discover this gap after a user reports a suspicious sign-in or an account begins behaving normally for the attacker.

How It Works in Practice

Attackers-in-the-middle sit between the user and the real service, proxying the login page so they can capture credentials, MFA codes, and often the resulting session cookie. That makes the strongest warning signs those that show the attacker has preserved the original authentication path while changing the endpoint, browser, or network path. A login may look successful in the identity provider, yet the session may originate from a different device, a non-managed browser, or an unexpected geographic source moments later.

Identity teams usually need to correlate authentication logs, browser telemetry, endpoint posture, and session activity. The clearest indicators include:

• multiple MFA prompts within a short window, especially when the user only expected one
• successful logins followed by access from suspicious domains or newly observed infrastructure
• sessions that continue in unmanaged browsers after the expected device is no longer present
• authentication events that succeed without the normal device-binding or conditional access signals
• account activity that is valid from the service’s perspective but inconsistent with the user’s normal behavior

Operationally, this is where phishing-resistant methods matter, especially FIDO2-bound authentication and tighter session controls. CISA guidance and the NIST SP 800-53 Rev 5 Security and Privacy Controls both reinforce stronger authentication assurance and session monitoring, while the 52 NHI Breaches Analysis is useful for understanding how identity compromise often persists after the initial login event. Where organisations also rely on service accounts or delegated tokens, the same defensive gap appears as credential replay and token abuse rather than a simple password theft event.

These controls tend to break down in legacy SSO environments with broad session reuse, long-lived tokens, or applications that do not expose enough telemetry to confirm whether a session was established through the genuine client.

Common Variations and Edge Cases

Tighter identity controls often increase friction, requiring organisations to balance user experience against the need to block token theft and session replay. That tradeoff becomes sharper in environments with contractors, shared workstations, BYOD devices, or applications that still depend on browser-based login flows without modern phishing resistance.

Some environments will see “normal” login success even when the user has been proxied, because the identity provider only validates the password and second factor, not the integrity of the browser path. Best practice is evolving toward device-bound credentials, risk-based step-up, and session revalidation at sensitive actions, but there is no universal standard for this yet. Phantom or ghost logins are especially important in federated estates, where one valid session can spawn multiple access paths across SaaS platforms, VPNs, and downstream APIs. The challenge is that the attacker may never need to reauthenticate once the first session is stolen.

NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks is a useful reference for understanding how credential lifecycle weaknesses extend attack dwell time, and the same logic applies to human sessions that remain trusted for too long. The organisations most at risk are those that equate “MFA completed” with “identity assured” instead of checking for browser integrity, token theft, and unexpected post-authentication behavior.

Related resources from NHI Mgmt Group

• What are the signs that legacy access controls are failing in a hybrid IT environment?
• What are the signs that application access token controls are failing?
• What are the signs that privileged access controls are failing in a distributed IT environment?
• What are the signs that an MCP server is failing its security boundary?