A relay attack places attacker-controlled infrastructure between the user and the legitimate service, capturing credentials and one-time codes in real time. In identity systems, it defeats simple MFA by replaying valid factors quickly enough to satisfy the challenge while the victim still believes they are signing in.
Expanded Definition
An adversary-in-the-middle relay is a live interception pattern in which the attacker sits between the user or agent and the legitimate service, forwarding traffic while harvesting credentials, session material, or one-time codes. In NHI and IAM environments, the critical distinction is that the attacker is not cracking authentication after the fact; they are using the victim’s own valid authentication exchange against them in real time. That makes the technique especially dangerous for workflows that still rely on reusable secrets, OTPs, or weak session binding. Guidance varies across vendors on whether the label should be reserved for phishing-proxy kits or also include broader token relay and session hijacking patterns, but the operational risk is the same: trust is transferred through an intermediary that should not exist. For a standards-oriented view of phishing-resistant authentication and replay resistance, see CISA cyber threat advisories and the practical NHI context in OWASP NHI Top 10. The most common misapplication is treating any MFA success as proof of safety, which occurs when the session is not bound to the original device, channel, or transaction.
Examples and Use Cases
Implementing strong relay resistance often introduces friction in login and agent authorization flows, requiring organisations to weigh user convenience against resistance to real-time interception.
- A helpdesk or SSO portal is proxied through attacker infrastructure, and the victim’s password plus OTP are relayed to establish a valid session before the prompt expires.
- An AI agent authenticates to an internal API using a short-lived token, but the relay intercepts the exchange and reuses the session to call downstream tools with the agent’s authority.
- A service account signs into a cloud console from an unmanaged endpoint, and the adversary relays the browser session to capture a usable authenticated context.
- In investigations of compromised NHIs, relay tactics are often paired with secret theft and token replay, which is why the patterns discussed in The 52 NHI breaches Report matter for interpreting how access was really obtained.
- Phishing-resistant authentication guidance from MITRE ATLAS adversarial AI threat matrix is useful when agentic systems must prove identity without exposing reusable factors to an intermediary.
Real-world deployments often blend relay with social engineering, malicious reverse proxies, and session token capture, so the term should be read as a chain of abuse rather than a single packet-level trick.
Why It Matters in NHI Security
For NHI security, adversary-in-the-middle relay matters because many machine identities are still protected by bearer-style secrets, long-lived tokens, or weakly scoped sessions. Once a relay succeeds, the attacker can impersonate a service account, API client, or autonomous agent without needing to persist malware on the target system. That turns a temporary compromise into unauthorized tool use, data access, or destructive automation. NHIMG research shows that 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage, which underscores how often identity compromise becomes operational impact. That risk is amplified when secrets and sessions are not rotated, when device trust is assumed, or when agent permissions are broader than the task requires. The lesson is reinforced by the broader NHI landscape in the Ultimate Guide to NHIs — Why NHI Security Matters Now and the issue framing in Top 10 NHI Issues. Organisations typically encounter this term only after a seemingly valid login or agent action is traced back to an unseen proxy, at which point adversary-in-the-middle relay becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Relay attacks exploit weak authentication flows and token handling in NHI systems. |
| NIST SP 800-63 | AAL3 | Phishing-resistant authenticators are the key defense against real-time relay attacks. |
| NIST CSF 2.0 | PR.AA-1 | Identity proofing and authentication controls must resist interception and replay. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust requires authenticated, continuously evaluated connections, not blind trust in a session. |
| OWASP Agentic AI Top 10 | LLM-03 | Agentic systems face relay risk when tool-use credentials can be intercepted live. |
Use phishing-resistant authenticators and bind sessions to the original verifier transaction.
Related resources from NHI Mgmt Group
- How should security teams stop adversary-in-the-middle attacks on MFA-protected accounts?
- Why do adversary-in-the-middle attacks still work when MFA is enabled?
- How should security teams reduce the risk of adversary-in-the-middle phishing?
- Why do OTP and push approvals fail against adversary-in-the-middle attacks?
