# What is Adversary-in-the-Middle (AiTM) Phishing?

> Adversary-in-the-middle phishing places attacker infrastructure between the victim and the real service, relaying the genuine authentication exchange live so the attacker captures credentials and the resulting session token.

- Canonical URL: https://yellowcube.eu/glossary/adversary-in-the-middle-phishing/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Phishing kits act as reverse proxies: the victim sees a convincing page, enters credentials and completes MFA on the real site through the attacker’s relay, and the attacker obtains a usable session cookie. This defeats SMS codes, one-time passwords, and push approvals — the factors are correct, but they are relayed rather than bound to the legitimate origin.

The defense boundary is cryptographic binding, not better judgment. Phishing-resistant authentication — passkeys, FIDO2/WebAuthn, certificate-based methods — ties the credential response to the legitimate origin, so a proxied page receives nothing replayable. Session protections shorten the window even when a token is stolen.

### Key points

- **Mechanism:** The attacker relays the real sign-in flow in real time, harvests credentials and the post-authentication session token, then uses the session from their own infrastructure.
- **Detection signals:** Impossible-travel or abnormal sign-in geography, new session characteristics after a recent login, token reuse from unexpected clients, and the phishing-domain infrastructure itself.
- **Defense:** Prefer phishing-resistant authenticators for high-risk users, bind and shorten sessions, alert on token reuse and anomalous session properties, and revoke sessions on suspicion.
- **Important limitation:** Phishing-resistant authentication protects the credential exchange, not the session after it. A stolen post-authentication token, a malicious OAuth consent, or a compromised endpoint still grants access without defeating any factor.

### Related terms

[Phishing](<https://yellowcube.eu/glossary/phishing/>) · [Phishing-resistant authentication](<https://yellowcube.eu/glossary/phishing-resistant-authentication/>) · [Session hijacking](<https://yellowcube.eu/glossary/session-hijacking/>) · [Multi-factor authentication (MFA)](<https://yellowcube.eu/glossary/multi-factor-authentication/>) · [Business email compromise (BEC)](<https://yellowcube.eu/glossary/business-email-compromise/>)

### Sources

[CISA, NSA, FBI, MS-ISAC, Phishing Guidance: Stopping the Attack Cycle at Phase One](https://www.cisa.gov/sites/default/files/2025-03/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One%20508.pdf) · [CISA, Phishing-Resistant Multi-Factor Authentication](https://www.cisa.gov/MFA) · [NIST SP 800-63B-4: Authentication and Authenticator Management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.