You clicked the link. Typed your password. Approved the MFA request. Got back to work.
What you didn’t know is that someone else logged into your Microsoft 365 account at exactly the same moment.
This is not a theoretical risk. It is happening to businesses that have done everything right, at least everything on the standard checklist. MFA enabled. Tick. Staff trained not to click dodgy links. Tick.
The attack is called Adversary-in-the-Middle phishing, or AiTM. It does not steal your password. It does not break MFA. It waits until you have already done both, and then steals something more valuable: proof that you already logged in.
Phishing has changed its target
For years, phishing was a credential-harvesting exercise. Fake page, stolen password, done.
That still happens, but the most effective attacks have moved on.
Modern phishing is after session tokens, not passwords. Once you successfully complete login and MFA, the service you just authenticated to issues a session cookie. That cookie tells the application you are already verified. No further checks needed. The system trusts whoever holds it.
AiTM attacks are built entirely around stealing that cookie.
The reason this matters is that MFA was designed to protect the login event. It was never designed to protect what comes after it.
What is actually happening during an AiTM attack
The phishing page you land on is not just a lookalike. It is a live proxy sitting between you and the real Microsoft or Google login service.
Every keystroke you type is passed through in real time. Every server response comes back through the same proxy. The MFA prompt appears because it is the real MFA prompt, just relayed through the attacker’s infrastructure. You complete it. You get through. The session cookie is issued.
The attacker grabs it.
From that point, they import the cookie into their own browser. No login required. No MFA challenge. They are already inside a fully trusted, already-verified session.
On most screens, the only visible clue is a slightly altered URL. On a phone, or when someone is trying to get through an email quickly, that goes unnoticed.
According to Microsoft’s 2024 Digital Defense Report, AiTM phishing attacks rose by 146% over the preceding year, driven largely by Phishing-as-a-Service platforms that package up ready-made proxy toolkits. Low technical skill required. Major cloud platforms targeted. Minimal setup.
Why this is hard to catch afterwards
There are no failed login attempts. No MFA alerts. Nothing in standard sign-in logs that signals a problem.
The attacker is operating inside a legitimate, authenticated session. Everything looks normal from the outside.
What tends to happen next is quiet and methodical. Hidden inbox rules are created to redirect email. A second MFA method is registered to lock in persistent access. Financial email threads are monitored. The compromised account is used to target finance teams or trusted contacts with further phishing.
By the time it surfaces, it is usually because something has already gone wrong: a payment redirected, data accessed, or a colleague asking why they received a strange message from a known email address.
What actually reduces the risk
MFA is still essential. Getting it right remains the baseline. But if you stop there, you are protecting the door and leaving the room unguarded.
Move to phishing-resistant MFA where you can
FIDO2 hardware keys and passkeys work differently to standard MFA methods. They bind authentication to the specific device and the legitimate domain. A proxy cannot relay them. If the URL is not the real one, the process fails.
The NCSC has published research specifically addressing this. Its guidance on FIDO2 credentials identifies AiTM attacks as the primary active threat against accounts using standard MFA, and explicitly recommends FIDO2 and passkeys for phishing resistance and theft resistance in a way that SMS codes and push notifications cannot match.
Not every business is ready to roll out hardware keys across the board. But knowing where your highest-risk accounts sit – executive email, finance, IT admin and prioritising those first is a practical starting point.
Set tighter session and conditional access controls
Short session lifetimes mean stolen cookies expire faster. Conditional access policies that flag new MFA method registrations, access from unusual locations, or activity outside expected hours give you a better chance of catching compromise before it escalates.
Authentication logs alone will not show you the problem. You need to be watching what happens after login.
Make sure staff know what AiTM lures look like
The technical controls matter more than awareness training here, but employees who understand that a working MFA prompt on an unfamiliar page is still a warning sign are more likely to pause and check before approving it.
A short walkthrough of what these campaigns look like in a Microsoft 365 context, what the URL patterns tend to be, and what to do when something feels off, takes thirty minutes and meaningfully changes behaviour.
MFA is a baseline, not a finish line
The businesses that handle this well are not necessarily the ones with the biggest security budgets. They are the ones that understand how sessions, tokens and identity trust work, and have built at least some controls around each layer.
If you are not sure whether your current setup would catch a session hijack, that is worth finding out before an incident does it for you.
We help businesses across Derbyshire and South Yorkshire work through exactly this kind of question. Get in touch or book a free consultation and we will take a look at what you have and where the gaps are.
Frequently Asked Questions
What is an AiTM attack? Adversary-in-the-Middle phishing uses a live proxy to sit between you and a real login service. The attacker intercepts your session cookie after authentication completes, giving them full access without needing your password or triggering MFA.
Does MFA stop AiTM attacks? Standard MFA does not, because AiTM attacks do not try to bypass MFA. They wait until you complete it successfully, then steal the session token that proves you already did. Phishing-resistant MFA methods such as FIDO2 and passkeys are specifically designed to address this.
What can we do to reduce the risk? Prioritise phishing-resistant MFA for your highest-risk accounts, tighten session controls and conditional access policies, and make sure staff know what these lures look like. Monitoring for unusual post-login activity matters as much as protecting the login itself.
