Adversary-in-the-middle attacks expose MFA’s weakest assumption

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WorkOS's blog post: Adversary-in-the-middle phishing proxies a real login session and steals the authenticated session cookie rather than just a password.

Why it matters: It matters because MFA, without phishing-resistant authentication and session controls, can still leave human identity programmes exposed to account takeover and post-login abuse.

Context

Adversary-in-the-middle attacks target the authentication ceremony itself, not just the password. A reverse proxy sits between the user and the legitimate service, forwards the login in real time, and captures the session cookie after MFA succeeds.

That breaks a common IAM assumption: that MFA completes the security story at sign-in. For human identity programmes, the real governance problem is not only proving who signed in, but limiting what a stolen authenticated session can do next.

The article treats AiTM as an operational phishing pattern rather than a niche technique. That is the right lens, because the control failure is architectural: the login flow remains relayable even when credentials and second factors are individually strong.

Key questions

Q: What breaks when MFA can be proxied through a reverse proxy?

A: What breaks is the assumption that completing MFA proves the session is trustworthy. In an AiTM attack, the attacker relays the login in real time, captures the session cookie, and can reuse that session without the second factor. Security teams need to treat session replay as the real failure mode, not just password theft.

Q: Why do phishing-resistant factors reduce AiTM risk more than OTP codes?

A: Phishing-resistant factors such as passkeys are origin-bound, so the authentication exchange cannot be transparently relayed to an attacker domain in the same way as OTP or push-based methods. That makes them materially harder to proxy. The key difference is not convenience but whether the credential can be presented outside its intended origin.

Q: What are the signs that an account has been taken over through AiTM?

A: Look for new MFA device registration, unexpected inbox forwarding rules, unusual cloud storage access, and session activity that changes user agents or locations after successful sign-in. Those behaviours often appear after the attacker has the valid cookie and is trying to establish persistence. Detection should focus on post-login behaviour, not only failed logins.

Q: How should teams respond when a valid session is reused from an unexpected location?

A: Treat it as a session integrity incident, not a simple password event. Revoke the session, review recent MFA device changes, inspect mail rules and cloud access, and check whether the account has started privileged or finance-related activity. The objective is to stop persistence before the attacker completes lateral abuse from the stolen session.

Technical breakdown

How adversary-in-the-middle proxies capture the session cookie

AiTM attacks use a reverse proxy that relays the user’s browser traffic to the real identity provider in real time. The victim sees the genuine login page, completes the password and MFA prompts, and receives no obvious signal that anything is wrong. The attacker’s proxy copies the session cookie issued after authentication, which becomes the real access token for the account. This is materially different from password theft because the attacker does not need to crack MFA or replay the password. Practical implication: controls that only validate the login ceremony are insufficient if the session token can be intercepted and reused.

Practical implication: design controls around session binding and token replay resistance, not just MFA completion.

Why classic MitM defenses do not stop AiTM

Classic man-in-the-middle threats usually depend on network interception, unencrypted traffic, or certificate manipulation. AiTM is an application-layer attack against the authentication workflow, so HTTPS alone does not remove the risk because the proxy terminates and re-establishes encrypted sessions on both sides. That means the attacker is not breaking transport security; they are rehosting the login in a way the browser and service both trust. Practical implication: network-layer trust indicators and password-centric phishing defenses do not address the primary failure mode in modern identity attacks.

Practical implication: move detection and protection up to the identity layer, including origin-bound authentication and device-aware session controls.

Why post-login persistence turns a compromised session into broader abuse

Once the attacker has the cookie, the account is already authenticated from the service’s point of view. That lets the attacker create new MFA devices, set inbox forwarding rules, access cloud files, and launch follow-on business email compromise from a legitimate session. Because the activity often originates from a valid authenticated context, many traditional anomaly checks do not trigger until the attacker has already persisted. Practical implication: post-authentication telemetry becomes a core control surface, not just an investigation aid.

Practical implication: monitor for new MFA device registration, forwarding rules, and unusual resource access immediately after sign-in.

Threat narrative

Attacker objective: The attacker wants a valid authenticated session that bypasses MFA and enables account takeover without needing the password or second factor again.

1. Entry occurs through a phishing lure that routes the victim to an attacker-controlled reverse proxy instead of a static fake login page.
2. Credential and MFA inputs are relayed live to the legitimate identity provider, which returns a valid session cookie after successful authentication.
3. The attacker captures that cookie and replays the authenticated session from elsewhere, then establishes persistence with new MFA devices or mail rules.
4. Impact follows through account takeover, email abuse, document access, and business email compromise from a session that appears legitimate in logs.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MFA is not the control boundary that many programmes still assume it is: AiTM attacks prove that a completed second-factor challenge does not guarantee a trustworthy session. The real boundary is whether the authentication ceremony can be proxied and the resulting session reused elsewhere. For human IAM programmes, that means the security model must shift from login approval to session integrity and replay resistance.

Session theft is the operational weakness AiTM exposes, not password quality: The article makes clear that these campaigns succeed even when users have strong passwords and MFA enabled. That collapses the assumption that credential strength plus second-factor completion equals secure access. Practitioners should treat the authenticated session as a governed asset with its own abuse path, not as an invisible after-effect of sign-in.

Phishing-resistant authentication changes the trust model, not just the user experience: Passkeys and other origin-bound methods matter because they prevent the proxy from relaying credentials in the first place. That is a materially different trust model from OTPs or push prompts, which can still be proxied in real time. The governance lesson is that authentication design must match the attacker’s relay capability, not the convenience profile of the user population.

AiTM makes post-login telemetry part of identity governance: New MFA device registration, inbox rule creation, and unusual cloud resource access are not merely detection signals. They are signs that the attacker has moved from session theft into persistence and operational abuse. Human identity programmes that stop at sign-in assurance leave the account lifecycle ungoverned after authentication.

Origin-bound authentication: The article’s core technical lesson is that origin binding is the practical answer to relay attacks because it stops the credential ceremony from being transplanted to an attacker domain. That concept is citable because it names the exact trust assumption AiTM breaks: the browser must know which origin is allowed to complete the authentication exchange. Teams should anchor their IAM roadmap around controls that preserve origin integrity, not just factor count.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Session integrity is now the decisive control surface: AiTM attacks show that password policy and MFA enrolment can both be present while the account is still vulnerable. Identity programmes need to move the centre of gravity from sign-in success to whether a session can be replayed, proxied, or rebound to another device.

Phishing-resistant authentication should be treated as a governance priority, not a user-experience upgrade: The article’s evidence shows that MFA completion alone does not stop takeover. That makes WebAuthn-style methods the more durable trust model for environments where account compromise leads directly to data access or financial abuse.

For practitioners

• Deploy phishing-resistant authentication Prioritise passkeys and other WebAuthn-based methods for user populations that routinely handle sensitive data or privileged workflows. Treat legacy OTP and push prompts as fallback paths that still need hardening because they remain relayable in AiTM scenarios.
• Bind sessions to the originating device Use device-aware controls, token binding where available, and conditional access checks that re-evaluate device posture during the session. The goal is to make stolen cookies materially harder to replay from an attacker-controlled machine.
• Watch for post-authentication persistence signals Alert on new MFA device registration, inbox forwarding rules, unusual user-agent changes, and access to cloud resources the account has never touched. These are the first signs that a stolen session has turned into durable compromise.
• Harden the email path that delivers the lure Inspect links that route through trusted file-sharing services, validate sender authenticity, and monitor for newly registered domains that mimic login pages. AiTM attacks often succeed before the user reaches the proxy, so email-layer controls remain necessary.

Key takeaways

• AiTM attacks succeed because they proxy the real authentication ceremony and capture the resulting session, which makes MFA completion an insufficient security endpoint.
• The article shows this is not a corner-case technique, with over 100 documented campaigns and a high share of compromised accounts already protected by MFA.
• Practitioners need controls that protect session integrity, not just login approval, including phishing-resistant authentication, device-aware access, and post-login persistence detection.

Key terms

• Adversary-in-the-Middle (AiTM): An attack pattern where the adversary sits between the user and the service to capture or replay authentication data and session state. The victim may still log in successfully, which is why the compromise often appears legitimate until privileged actions begin. AiTM is especially dangerous for admin workflows that trust issued sessions too much.
• Persistent Cookie: A persistent cookie is a session cookie that remains valid after the browser closes until it expires or is explicitly removed. In remote access designs, it can improve usability, but it also increases the chance that a reused session becomes standing access if the organisation does not enforce compensating controls.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Session Integrity: Session integrity is the assurance that an authenticated connection remains trustworthy after sign-in. It covers token use, channel validation, and device posture, because attackers often target the session after the login event rather than the login event itself.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.