AiTM

Description

The point is that the stolen session token has already passed MFA. The attacker reuses it and is logged in as the user, with no need to know the password again or pass a second MFA step. This is the technique that makes 'we have MFA' insufficient on its own.

Delivery is via a phishing link to the proxy, usually by mail or message; ready-made kits (reverse proxies) make this a point-and-click job.

Examples

• A municipal employee gets an email with a link to a 'portal login'; the page is a proxy that forwards everything to the real service and captures the session token in flight, despite the entered MFA code.
• A user at a small business enters their password and confirms MFA on a fake page; the attacker uses that token to enter the mailbox with no extra step.
• A bank rolls out MFA and considers the account solved; AiTM bypasses exactly that assumption.

Notes

• AiTM doesn't break MFA — it lets you enter it and then steals what MFA produces: the session.
• Phishing-resistant factors (FIDO2 keys, bound to the real domain) are the answer; SMS and app codes don't help here.