What is an AiTM (adversary-in-the-middle) attack?
An AiTM attack, short for adversary-in-the-middle, relays your login through the attacker's server and captures your session, even with two-factor security turned on.
How the attack works
An ordinary fake page collects your password for later, and two-factor security defeats that. An AiTM attack sits in the middle of a real login instead, live. You click a link and land on the attacker's server, which passes everything between you and the real website. You see the real login screen, forwarded through the attacker.
- You type your password. The relay forwards it and reads it on the way.
- The real site asks for your two-factor code. You enter it. The relay forwards that too.
- The real site sends back a session token, a small proof that says "this person is signed in".
- The attacker copies the token and opens your account. Your two-factor step is already behind them.
Why two-factor does not stop it
You supply the second proof yourself, a code from an app or a text, and the relay forwards it like everything else. The defense has to catch the attack earlier, at the fake link, before you type anything.
How to spot one
The relay has to live at an address that is not the real brand, and that is where the truth leaks out.
- A real Microsoft login ends in microsoft.com. A relay might read login.microsoft.secure-verify.com or office365-signin.account-check.net.
- Be wary of any login you reached from a link in an email, a message, or a document.
- A brand name in the middle of a long address means nothing. The owner is the part right before the ending.
How to protect yourself
Reach important logins yourself: type the address or use a bookmark. A password manager stays silent on a relay address, and that silence is a warning. Use passkeys or a hardware security key where offered. They are tied to the real address and refuse to sign in on a relay.
Fish Catcher warns you in plain language when a sign-in or code prompt sits on an address that does not match the brand it imitates. It never blocks the page.
Common questions
What does the attacker gain from my session token?
Proof that you are already signed in, which opens your account without your password or code until the session is ended.
Are passkeys safe against AiTM attacks?
Yes. They tie your login to the real web address, so they refuse to work on a relay page.
How do I recover if I signed in through one?
Change your password and sign out of all sessions, which cancels the stolen token. For a work account, tell your security team.