Topic starter
24/06/2026 10:24 pm
TL;DR: Adversary-in-the-middle attacks use phishing plus proxy infrastructure to steal credentials and session cookies, letting attackers bypass MFA and reuse trusted sessions, according to 1Kosmos. The security gap is not only user susceptibility but also the assumption that authentication proves ongoing session legitimacy.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What is an Adversary-In-The-Middle (AiTM) Phishing Attack?”.
Key questions
A: Traditional MFA can fail if the attacker intercepts the login session or relays the authentication flow in real time.
Q: Why does a successful MFA login still leave organisations exposed to AiTM attacks?
A: Because the risk shifts from proving identity at login to preserving trust throughout the live session.
Q: How should security teams reduce the risk of MFA bypass through AiTM phishing?
A: Treat MFA as one control in a broader session-security chain.
Practitioner guidance
- Deploy phishing-resistant authentication for high-value access Require methods such as FIDO2 or WebAuthn where the service can verify origin and bind the user more strongly to the login ceremony.
- Instrument live session monitoring and revocation Monitor for abnormal session reuse, impossible travel, and unexpected device or browser context shifts, then terminate the session immediately when risk appears.
- Tighten conditional access around domain and device context Restrict access to approved domains and client states so that a relayed browser flow cannot silently inherit trust.
Bottom line: AiTM phishing is dangerous because it steals the authenticated session, not just the password, which lets attackers operate inside MFA-protected environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:03 am
Session legitimacy is the real trust boundary, not MFA completion: AiTM attacks work because authentication is treated as a one-time event even though the attacker can steal the session state that follows it. That means identity assurance ends up being validated at login while abuse happens after login, inside a trusted session. Practitioners should read this as a governance failure in session assurance, not a user-only phishing problem.
A few things that frame the scale:
- Tycoon 2FA alone accounted for 62% of phishing detected by Microsoft and over 64,000 confirmed incidents.
A question worth separating out:
Q: When should teams prioritise session revocation over additional login prompts?
A: When the attacker may already hold a valid session cookie or token. Extra prompts do little once the session is captured, so teams should prioritise immediate invalidation of the live session and tighter policy enforcement on sensitive access paths.
👉 Read our full editorial: Adversary-in-the-middle attacks expose MFA trust gaps