What is an AiTM (adversary-in-the-middle) attack?
An AiTM attack, short for adversary-in-the-middle, is a phishing method where the attacker secretly relays your login through their own server so they capture your session even when you use two-factor security.
How the attack works
In an ordinary phishing scam, a fake page collects your password and the attacker uses it later. That fails against two-factor security, because a stolen password alone is not enough. An AiTM attack solves that problem for the attacker by sitting in the middle of a real login in real time.
Here is the shape of it. You click a link and land on the attacker's server. That server is not a static fake page. It quietly passes everything you send to the genuine website and passes the genuine website's replies back to you. You see the real login screen, because it is the real login screen, forwarded through the attacker.
- You type your username and password. The attacker's server forwards them to the real site and reads them on the way through.
- The real site asks for your two-factor code. You enter it. The attacker forwards that too.
- The real site accepts the login and sends back a session token, a small piece of proof that says "this person is signed in".
- The attacker copies that token. Now they can load your account as if they had signed in themselves, and your two-factor step is already behind them.
The password and the code did their job. The weak point is the session token that gets handed out afterward. Steal the token, and you skip the whole front door.
Why two-factor does not stop it
Two-factor security asks for a second proof, like a code from an app or a text message. That defeats a plain password thief. It does not defeat an attacker who relays your login live, because you provide the second proof yourself, in the moment, and the attacker forwards it along with everything else.
This is why AiTM attacks worry security teams. Many people believe that turning on two-factor makes them safe from phishing. It helps a great deal, but it does not close this specific gap. The defense has to catch the attack earlier, at the fake link, before you ever type anything.
How to spot one
The relay server has to live somewhere, and that somewhere is a web address that is not the real brand. The login screen may look perfect, pixel for pixel, because it is a live copy. The address bar is where the truth leaks out.
- Read the address before you sign in. A real Microsoft login ends in microsoft.com. An AiTM page might read login.microsoft.secure-verify.com or office365-signin.account-check.net.
- Be wary of any login you reached by clicking a link in an email, a message, or a document, especially one that felt urgent.
- Watch for a brand name buried in the middle of a longer address. Attackers put the real name where it will catch your eye, but the true owner of the site is the part right before the ending.
- Treat an unexpected request to sign in as a reason to slow down, not speed up.
How to protect yourself
The strongest habit is to reach important logins yourself. Type the address by hand or use your own saved bookmark instead of following a link. A password manager helps too: it fills your details only on the exact site it saved them for, so it stays silent on a lookalike address, which is a quiet warning that the page is wrong.
Fish Catcher is built to catch this exact trick. It watches for a sign-in or code prompt on a site whose address does not match the brand it is imitating, which is the heart of an AiTM attack. When it sees that mismatch, it shows a plain warning and a risk color that tells you how strong the signs are. It never blocks the page. You always decide, but now you decide with the warning in front of you instead of after your session has been taken.
Common questions
What does the attacker gain from my session token?
The token is proof that you are already signed in. With it, the attacker can open your account without your password or your two-factor code, because the site already trusts the token. They may read your email, reset other accounts, or send messages as you until the session is ended.
Are passkeys safe against AiTM attacks?
Passkeys and hardware security keys are much stronger here. They tie your login to the real web address, so they refuse to sign in on a lookalike relay page. Where a service offers them, they remove the gap that AiTM attacks depend on.
How do I recover if I signed in through one?
Change your password right away and sign out of all active sessions, which cancels the stolen token. Review recent activity and connected apps for anything you did not do. For a work account, report it to your security team so they can revoke access and check for further steps by the attacker.