Passwordless identity assurance and MitM risk in enterprise access

At a glance

What this is: HYPR's article explains how MitM attacks intercept credentials and session material, and why phishing-resistant passwordless MFA reduces that replay risk by removing secrets from the access path.

Why it matters: It matters because IAM teams need to understand that traditional MFA can still leave phishable, replayable factors in place, while passwordless authentication changes the trust model for human access.

Context

Man-in-the-middle attacks work by inserting an attacker between a user and a legitimate service so that authentication data, session tokens, and traffic can be observed or altered in transit. In IAM terms, the problem is not only interception but the continued usefulness of what gets stolen, which is why replayable factors remain a governance weakness for human identity programmes.

The article frames phishing-resistant passwordless MFA as the practical countermeasure because it removes secrets that can be relayed or reused. For enterprise access, that changes the control question from how to strengthen a password-based journey to how to eliminate phishable factors from the login path entirely.

Key questions

Q: How should security teams detect man-in-the-middle proxy attacks on login flows before credentials are stolen?

A: Security teams should place a detection token in the website or identity provider login page and restrict it to approved domains. When a user session is proxied from an unexpected domain, the control can flag the attempt and surface the affected application, helping teams respond before stolen credentials are reused for account takeover or unauthorized purchases.

Q: Why do OTPs and push approvals still leave MitM risk in place?

A: Because both can remain phishable or relayable under a real-time MitM attack. An attacker who captures or socially engineers those factors can still impersonate the user, so the control problem is not just second factor count but whether the factor can be reused by someone else.

Q: What signs indicate a session may have been hijacked after login?

A: Watch for unusual token reuse, sudden geolocation shifts, mismatched device signals, and access that continues after the original authentication context should have changed. Those patterns suggest the attacker did not just steal credentials, but retained authenticated state.

Q: What should teams do when remote access still depends on replayable authentication factors?

A: Treat that as a prioritisation problem and move the highest-risk access paths to phishing-resistant passwordless MFA first. Remote access over public or untrusted networks is where replayable factors are easiest to exploit, so the first change should be on externally reachable access methods.

Technical breakdown

How MitM attacks intercept identity proof and session state

A MitM attack places an adversary between endpoints so traffic can be read, modified, or replayed without either side realising it. In practice, the attacker may use rogue access points, DNS spoofing, SSL stripping, or phishing kits that capture credentials and session tokens. Once a session token is stolen, the attacker can act as the legitimate user until expiration, which makes post-login compromise as important as initial authentication. The key technical point is that transport encryption alone does not stop identity theft if the attacker can capture a reusable proof or token at the edge of the session.

Practical implication: Treat authentication material and session state as separate protection problems, not one control.

Why passwordless MFA changes the attacker’s economics

Phishing-resistant passwordless MFA uses public-key cryptography so the authenticator proves possession of a private key without sending a reusable secret across the network. That means there is no password, OTP, SMS code, or push approval for an attacker to intercept and relay in a MitM flow. The article correctly distinguishes this from generic MFA: adding another phishable factor still preserves the replay problem. The security gain comes from replacing shared, replayable secrets with cryptographic challenge-response tied to the authenticator and domain context.

Practical implication: Use phishing-resistant authentication when the threat model includes interception, relay, or token theft.

Where VPNs and IDS help, and where they stop

VPNs, firewalls, and intrusion detection can reduce exposure by encrypting traffic, constraining network paths, and flagging suspicious behaviour, but they do not remove the underlying trust assumption that the login factor can be stolen and replayed. That is why the article places strong authentication ahead of perimeter controls. Network controls still matter for spotting suspicious infrastructure and reducing exposure on untrusted networks, especially for remote workers, but they are compensating controls rather than the identity control that breaks the MitM chain.

Practical implication: Use network controls as containment layers, but do not rely on them to solve identity replay risk.

Threat narrative

Attacker objective: The attacker wants to impersonate a legitimate user, bypass authentication, and gain durable access to the account or session.

1. Entry occurs when the attacker positions a rogue access point, spoofs DNS, or uses phishing infrastructure to insert themselves between the user and the target service.
2. Credential access follows when the attacker captures passwords, OTPs, push approvals, session cookies, or other replayable authentication material in transit.
3. Escalation happens when the stolen material is replayed to impersonate the user and bypass normal authentication checks.
4. Impact is achieved when the attacker gains authenticated access to the account, monitors communications, or initiates fraudulent actions as the victim.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing-resistant identity assurance is now the real control boundary. The article shows that MitM attacks exploit the difference between a user being authenticated and a secret being replayable. Once that distinction is clear, the operational question changes from adding another factor to removing phishable factors from the access path. For human IAM teams, the decisive issue is whether the control can still be relayed by an attacker in real time.

Session theft, not just password theft, is the MitM failure mode that matters. The article correctly moves beyond credentials to tokens, cookies, and email access, which is where many organisations still underinvest. A login that resists phishing but leaves session artefacts easy to hijack still creates account takeover risk. The implication is that assurance has to extend through the whole authenticated session, not stop at the login ceremony.

Remote access is where the weakest trust assumptions cluster. Remote workers on open or hostile networks are a natural target because network location no longer signals trustworthiness. That makes passwordless access, device trust, and session protection part of the same governance conversation rather than separate projects. The implication is that zero trust for human access has to assume network compromise as a baseline condition.

Replayable factors are a governance debt, not just a user convenience issue. OTPs, SMS codes, and push approvals can still be intercepted, relayed, or socially engineered, which means they preserve an attacker path even when MFA is technically present. The article’s emphasis on FIDO-based passwordless authentication is therefore less about usability and more about closing a structural control gap. Practitioners should treat phishable factors as residual risk that must be designed out.

Passwordless assurance should be measured by resistance to relay, not by adoption alone. A programme can report broad MFA coverage and still leave the environment exposed if the deployed factors remain replayable. The meaningful signal is whether the authentication method can survive interception without yielding a reusable secret. Practitioners should assess whether their access controls actually remove the attacker’s ability to reuse identity proof.

What this signals

Phishing resistance is the governance threshold, not MFA coverage. Many IAM programmes still report success at the level of factor count, but MitM risk lives in the replayability of the factor itself. If the login secret or approval can be intercepted and reused, the access path remains exploitable even when MFA is technically present.

Session-aware identity security has to sit alongside access policy. The article’s examples show that compromise often happens after the initial prompt, which means token theft and browser session abuse are part of identity assurance, not just incident response. Practitioners should treat session integrity as a first-class control objective for human access.

For practitioners

• Prioritise phishing-resistant passwordless MFA Replace passwords and other replayable factors on high-risk enterprise access paths with FIDO-based authentication that cannot be relayed by an attacker in transit.
• Remove OTP and push fallback paths Eliminate SMS codes, OTPs, and push approvals from environments where MitM relay is a realistic threat, because those factors can still be intercepted or socially engineered.
• Harden remote access entry points Review VPNs, public WiFi exposure, and browser-based login flows together so remote workers are not relying on network trust to compensate for weak authentication.
• Monitor for session hijacking indicators Add detection and response playbooks for stolen cookies, token reuse, and anomalous post-login behaviour, since MitM attacks often succeed after the initial authentication step.
• Validate FIDO end-to-end coverage Check whether the deployed passwordless stack remains phishing-resistant across desktop sign-in, VPN access, and application authentication rather than only at the primary login screen.

Key takeaways

• MitM attacks remain effective because they target the parts of access that can be intercepted and replayed, not just weak passwords.
• Passwordless MFA changes the risk model by removing reusable secrets from the login path, which is the core improvement in this article.
• For practitioners, the key question is whether authentication factors and session state can still be reused by an attacker after interception.

Key terms

• Man-in-the-Middle Attack: A man-in-the-middle attack is an interception technique where an attacker positions themselves between two parties that believe they are communicating directly. The attacker can read, alter, or replay traffic, which makes the attack especially dangerous when credentials, sessions, or certificates are involved.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.
• Replayable factor: An authentication method or secret that can be captured and used again by an attacker. SMS codes, OTPs, and some push approvals can fall into this category because they do not always bind the request to a trusted device or a non-transferable proof of possession.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.