AiTM (adversary-in-the-middle)
An adversary-in-the-middle (AiTM) attack is a form of phishing in which a proxy server sits between the victim and the real sign-in page, such as Microsoft 365, and captures the password and session cookie after the user completes MFA (multi-factor authentication). It is a variant of the man-in-the-middle attack aimed at stealing sessions; phishing-resistant MFA, such as passkeys, reduces its effectiveness.
How TecnetOne handles it: TecnetSOC
AiTM phishing, AiTM attack, reverse proxy phishing, MFA bypass phishing, evilginx
Related terms
Consent phishing (OAuth)
Consent phishing is an attack that tricks a user into authorizing a malicious application through OAuth (Open Authorization), which gives the app access to their email or files without ever learning the password. Because the user grants the permission, multi-factor authentication (MFA) does not stop it, and a password reset alone does not revoke that access.
Synthetic identity fraud
Synthetic identity fraud uses a fabricated identity that combines real data, such as a stolen Social Security number, with fake details, such as a different name or address, to open accounts or obtain credit. Because there is no single victim to report it, it can go undetected for months. Banks, fintechs and lenders that onboard customers online are the main targets.
Session hijacking and token theft
Session hijacking is an attack in which a third party steals the identifier of an already authenticated session, such as a session cookie or access token, and replays it to sign in as the user without the password or another MFA (multi-factor authentication) prompt. Unlike credential theft, what is stolen is the live session; attackers often obtain it through infostealers or adversary-in-the-middle phishing.
Secure remote access
Secure remote access is the set of technologies and policies that lets staff and vendors connect to company systems from outside the office without exposing them. It combines an encrypted path, such as a VPN (virtual private network) or ZTNA (zero trust network access), with MFA (multi-factor authentication) and least-privilege permissions. Exposing RDP (Remote Desktop Protocol) directly to the internet is the opposite.
Just-in-time (JIT) access
Just-in-time (JIT) access is a model in which elevated privileges are granted only when needed, for a specific task and a limited time, and are removed automatically when that time expires. This eliminates administrator accounts with standing permissions. For example, a technician requests admin access to a server for two hours, and the system revokes it once that window closes.
Password spraying
Password spraying is a brute-force attack that tries a few common passwords, such as the company name plus the current year, against many accounts at once. By making only a handful of attempts per account, it avoids lockout thresholds. It often targets sign-in portals such as Microsoft 365, and MFA (multi-factor authentication) combined with banned weak passwords reduces its effectiveness.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.