Adversary-In-The-Middle Proxy

What the proxy does

An adversary-in-the-middle proxy is a relay point that lets the attacker sit between the victim and a real service while preserving the appearance of a normal login flow. That makes it useful for stealing session material after the user has already passed authentication.

The key danger is that the proxy does not need to break the service itself. It abuses trust in the live web session, so the attacker can capture cookies, bearer tokens, or other secrets and then reuse them to act as the user.

Why it works against modern authentication

This technique is especially effective when the defender relies on password entry, MFA prompts, or short-lived web sessions alone. If the attacker can relay the interactive flow and harvest the resulting session artefact, they may bypass the very control that was supposed to stop phishing.

In practice, the proxy succeeds because many services still trust a valid session token more than the original login event. Once that token is stolen, the attacker often no longer needs the password or the second factor.

Where it shows up in phishing campaigns

Adversary-in-the-middle proxies are commonly delivered through phishing kits that imitate a legitimate sign-in page and forward traffic to the real service in real time. That allows the victim to complete login while the attacker quietly records the resulting session cookie or token.

It can also be paired with consent abuse, device-code phishing, or other identity abuse paths when the goal is persistent access rather than a one-time credential theft. The proxy is the relay mechanism that turns a convincing lure into usable access.

What defenders need to protect

Defence is strongest when organisations reduce the value of relayed authentication altogether by using phishing-resistant sign-in methods, strong token binding where supported, and tighter session controls. Detection also matters, because a successful relay can look like a normal login until the session is reused from a different device or location.

After an incident, the response should focus on the session artefacts, not just the password. Stolen cookies, refresh tokens, OAuth grants, and any recovery paths that the attacker may have used should be treated as compromised, then invalidated and reviewed.

For practical guidance on this attack pattern, see MITRE ATT&CK T1557 Adversary-in-the-Middle, AiTM Phishing Guide, and Identity Provider and SSO Security Guide.

Risk and Threat Considerations

An adversary-in-the-middle proxy turns a single successful phishing interaction into durable account compromise, because the attacker can capture the authenticated session rather than only the password. That makes the technique especially dangerous in environments that rely heavily on browser sessions and federated sign-in.

Failure mechanism: The proxy relays the victim’s live authentication exchange to the legitimate service, then steals the resulting session cookie, token, or other bearer secret and reuses it from attacker-controlled infrastructure.

Impact: The attacker can impersonate the user, access sensitive data, perform actions inside the account, and sometimes move into adjacent systems that trust the same session or identity provider.

Practitioner Guidance

Why practitioners should care: This is not just a phishing variant, it is a session-theft mechanism. Defenders should assume that a successful relay attack can bypass controls that only validate the login ceremony and not the integrity of the session that follows.

What to watch for: Reused sessions from unusual IP ranges, impossible travel patterns, unfamiliar user agents, or logins that succeed despite a recent MFA challenge can all indicate relay abuse. Those signals are especially important when the service issues bearer-style session material that can be replayed elsewhere.

Practitioner takeaway: Treat phishing-resistant authentication and session hardening as complementary, because blocking the initial login prompt is not enough if the resulting session can still be stolen and replayed.

Related resources from NHI Mgmt Group

• What are the signs that an adversary-in-the-middle phishing campaign is being coordinated through live session control rather than a simple reverse proxy?
• How should security teams stop adversary-in-the-middle attacks on MFA-protected accounts?
• Why do adversary-in-the-middle attacks still work when MFA is enabled?
• How should security teams reduce the risk of adversary-in-the-middle phishing?