What are the signs that a holiday phishing campaign is using an adversary in the middle technique instead of simple credential theft?

A strong indicator is a fake sign in flow that captures more than a password. Look for QR code based entry, branded login pages, harvested MFA tokens, and session cookie retrieval. If the page behaves like a real organisation login but immediately requests authentication details after an email address is entered, the attacker is likely aiming for session hijacking.

How an adversary in the middle campaign differs from simple credential theft

The key difference is what the attacker captures after the user enters credentials. Simple credential theft usually ends with a password or account token that can be reused later. An adversary in the middle setup sits between the user and the real service in real time, so it can intercept MFA codes, relay authentication, and steal session material that keeps the victim logged in.

A fake sign-in page that behaves like a normal login but quietly proxies traffic is therefore more dangerous than a static phishing page. The user may see a convincing brand and a routine prompt, while the attacker harvests both initial credentials and the authenticated browser session that follows.

In practice, this distinction matters because the victim may have already passed the login step by the time the attacker takes over. That means defenders should treat the page flow, the token handling, and the post-login session state as part of the attack surface, not just the password field.

What signs point to session hijacking rather than just password capture?

Look for signs that the phishing page is trying to preserve a live relay to the real service. QR code based sign-in is a strong clue because it can move authentication to a mobile device or alternate channel that the attacker can proxy. Likewise, requests for MFA tokens, one-time codes, or repeated prompts after a correct email address are entered suggest the page is fishing for more than a password.

Brand fidelity is another clue, but it is not enough by itself. Many phish use polished lookalike pages; the stronger signal is that the page behaves dynamically, passing the victim through multiple authentication steps or error messages that mimic a real identity provider. If the page asks for credentials and then immediately asks for a verification step, the attacker is likely trying to relay a live login rather than simply collect static credentials.

Session cookie retrieval is the clearest sign of the more advanced technique. If an attacker can obtain a valid session cookie, they may bypass MFA altogether and act as the user until the session expires or is revoked. That changes the incident from a password reset problem into a live access containment problem.

When the login page appears to be normal but the interaction quickly escalates into MFA capture, token replay, or cookie theft, the likely objective is to steal the authenticated session. That is especially important when the victim reports that the first page looked legitimate, the email address was accepted, and the attacker then requested an OTP, push approval, or reauthentication.

For defenders, the practical question is whether the compromise can still be contained by changing the password alone. If the attacker has obtained a session cookie, refresh token, or browser-bound authentication artifact, password reset may not end the incident. The response needs to include session invalidation, token revocation where possible, and review of recent sign-in activity for signs of relay abuse.

For context on how these attacks are typically mapped, the MITRE ATT&CK Enterprise Matrix is useful for relating credential access, token theft, and lateral movement to the broader attack chain. Teams that want a practical authentication hardening baseline should also review NIST SP 800-63 Digital Identity Guidelines, which emphasise phishing-resistant authentication methods.

Risk and Threat Considerations

Adversary in the middle phishing raises the risk level because the attacker can turn a single successful login into ongoing account control. The main danger is that the victim appears to authenticate successfully, which can delay detection while the attacker captures session material and moves through the account.

Failure mechanism: The attacker relays the victim’s authentication in real time, captures MFA responses or session artifacts, and reuses those artifacts to impersonate the user without needing the password again.

Impact: A compromise can persist beyond password reset, enabling mailbox access, SaaS takeover, payment diversion, data exfiltration, and secondary phishing from the trusted account.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-63, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1556 — Modify Authentication Process	Real-time phishing and session relay abuse authentication and tokens.
Recommendation — Map the flow to credential access and revoke active sessions fast.
NIST SP 800-63	Digital Identity Guidelines	Phishing-resistant authentication is central when MFA relay and session theft are signs.
Recommendation — Prefer phishing-resistant authenticators and reduce replayable login factors.
CIS Controls v8	CIS-6 — Access Control Management	Session compromise requires rapid access revocation and account containment.
Recommendation — Revoke exposed access paths and review privileged account activity.
OWASP ASVS	V10 — OAuth and OIDC	Token theft and relay attacks affect federation and sign-in flows.
Recommendation — Harden OAuth/OIDC flows against token replay and session hijacking.
OWASP API Security Top 10	API2 — Broken Authentication	The technique abuses authentication trust rather than simple password collection.
Recommendation — Verify authentication handling cannot be relayed or bypassed.

Practitioner Guidance

What to verify: Check whether the suspicious login flow captured only static credentials or also session state, MFA approvals, or token material. If the user completed a real authentication path before the alert, treat the event as a potential session compromise rather than a simple credential reset case.

Common mistake: Teams often stop at password rotation and user re-education. That is insufficient when the attacker has already established an authenticated browser session, because the active session may remain valid after the password changes.

Practitioner takeaway: The decisive question is not whether a password was stolen, but whether the attacker obtained a usable authenticated session. If the answer may be yes, contain the session first and then investigate the phishing flow.