Topic starter
04/06/2026 6:48 pm
TL;DR: Man-in-the-middle attacks are increasingly used to intercept credentials, session tokens, and network traffic, and HYPR argues that phishing-resistant passwordless MFA removes the secret an attacker can steal, while CISA and other bodies treat FIDO-based authentication as the gold standard. The decisive issue is not just stronger login, but eliminating replayable factors from the access path.
Editorial analysis by NHI Mgmt Group, based on content published by HYPR: “How to Prevent Man-in-the-Middle Attacks”.
Key questions
A: Security teams should place a detection token in the website or identity provider login page and restrict it to approved domains.
Q: Why do OTPs and push approvals still leave MitM risk in place?
A: Because both can remain phishable or relayable under a real-time MitM attack.
Q: What signs indicate a session may have been hijacked after login?
A: Watch for unusual token reuse, sudden geolocation shifts, mismatched device signals, and access that continues after the original authentication context should have changed.
Practitioner guidance
- Prioritise phishing-resistant passwordless MFA Replace passwords and other replayable factors on high-risk enterprise access paths with FIDO-based authentication that cannot be relayed by an attacker in transit.
- Remove OTP and push fallback paths Eliminate SMS codes, OTPs, and push approvals from environments where MitM relay is a realistic threat, because those factors can still be intercepted or socially engineered.
- Harden remote access entry points Review VPNs, public WiFi exposure, and browser-based login flows together so remote workers are not relying on network trust to compensate for weak authentication.
Bottom line: MitM attacks remain effective because they target the parts of access that can be intercepted and replayed, not just weak passwords.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 7:01 pm
Phishing-resistant identity assurance is now the real control boundary. The article shows that MitM attacks exploit the difference between a user being authenticated and a secret being replayable. Once that distinction is clear, the operational question changes from adding another factor to removing phishable factors from the access path. For human IAM teams, the decisive issue is whether the control can still be relayed by an attacker in real time.
A question worth separating out:
Q: What should teams do when remote access still depends on replayable authentication factors?
A: Treat that as a prioritisation problem and move the highest-risk access paths to phishing-resistant passwordless MFA first. Remote access over public or untrusted networks is where replayable factors are easiest to exploit, so the first change should be on externally reachable access methods.
👉 Read our full editorial: Passwordless identity assurance and MitM risk in enterprise access