Simple definition
An AiTM attack places an attacker-controlled system between a person and a legitimate service to intercept communications or an authenticated session.
Purpose and use
The attacker may seek passwords or session cookies. Some MFA methods can still be defeated when authentication is relayed through the intermediary.
How does it work?
A phishing page can forward traffic to the genuine identity provider. A successful sign-in therefore does not prove that the browser used the correct domain.
Key points
- Example: a Microsoft 365 sign-in following an email link succeeds, but subsequent session activity appears in an unfamiliar context.
- Correlate the visited URL, sign-in records, devices and mailbox actions. A single unusual event does not establish that an account was compromised.
Points to watch
Prefer phishing-resistant authentication and respond to stolen sessions. A password reset alone does not necessarily terminate every existing session.
In short
AiTM is an active interception of trust, with a particular risk of session theft.