MFA Is a Baseline, Not a Finish Line: How Adversary-in-the-Middle Attacks Steal Your Active Login
You click a link, sign in, approve the multi-factor prompt on your phone, and get on with your morning. Nothing looks wrong. What you can’t see is that someone else just stepped into your account at the same moment, using the exact session you just opened.
That is an Adversary-in-the-Middle (AiTM) attack, and it is the reason we keep telling clients that multi-factor authentication (MFA, the second check after your password) is a baseline, not a finish line. AiTM doesn’t break MFA. It waits politely for you to pass it, then walks through the door behind you.
If your business runs on Microsoft 365 or Google Workspace, this is the threat worth understanding this year.
Phishing has moved past your password
Old-school phishing wanted your username and password so an attacker could log in later. The problem for them is that MFA usually blocks that. Type a stolen password into Microsoft 365 and you still hit the second prompt, and the attempt dies there.
So the goal changed. Modern phishing is after the authenticated session itself, the trusted state your account is in once you’ve already proven who you are. That state is held in a session cookie (a small token your browser keeps so you’re not asked to log in on every click). Whoever holds that token holds the access, no password or MFA required.
The tooling has matured fast. Phishing-as-a-Service kits now hand low-skilled attackers ready-made toolkits that run these attacks at scale against the big cloud providers. You no longer need to be sophisticated to run a sophisticated attack.
How the attack really works
An AiTM phishing page is not a cheap copy of a login screen. It is a live relay sitting between you and the real Microsoft or Google sign-in. Every keystroke and every prompt passes through the attacker’s system and on to the genuine service in real time.
From your side, everything behaves correctly. The branding is right, the password works, the MFA prompt appears on your phone and approves cleanly. The only tell is usually a slightly-off web address, which is easy to miss on a phone screen or when you’re rushing between jobs.
Here is the part that catches people out. MFA protects the moment you log in, not the hours afterwards. The second you complete that prompt, the service issues your session cookie, and the attacker relaying your login simply grabs it as it’s created. They load it into their own browser and pick up your session exactly where you left off, inside a fully trusted account.
Microsoft tracked a 146% rise in AiTM attacks over the past year as criminals shifted their focus to accounts already protected by MFA. The Canadian Centre for Cyber Security reviewed more than 100 of these campaigns aimed at Microsoft accounts and found a clear pattern: phishing-resistant methods stopped the session theft, while standard MFA like push notifications and one-time codes did not.
The quiet part is what hurts
What makes AiTM dangerous is how little noise it makes. The attacker is working inside a legitimate, verified session, so there are no failed logins, no strange MFA alerts, and nothing obvious in the standard sign-in logs.
Research from Proofpoint shows what tends to happen next. The intruder sets up hidden inbox rules to quietly redirect mail, registers their own MFA method to keep a foothold, watches email threads for conversations about money, and uses the trusted account to phish colleagues and your finance team from the inside.
That is why these attacks are so often found late, after a fraudulent invoice has been paid or data has already walked out the door. We see the same story across the Northern Beaches: a business with MFA switched on, assuming that box was ticked, with no visibility into what happens after login.
Reducing your exposure
MFA is still essential. Switching it on correctly is the right starting point and we are not suggesting otherwise. Reducing AiTM risk just means adding controls that reach past the login screen.
Move to phishing-resistant MFA. Passkeys and FIDO2 hardware keys (a physical key or your phone’s built-in security chip) bind your login to the real web address. A relay in the middle can’t pass them on, because the check fails the instant the address isn’t genuine. This is the single biggest lever, and it’s the same shift we cover in our piece on why MFA alone won’t save you and the move toward passkey sign-ins.
Tighten the rules around access. Conditional Access policies can flag the activity that gives an intruder away: a new MFA method appearing, inbox rules created at odd hours, or sign-ins from places your team never works from. Login logs alone won’t show you this, so the monitoring has to watch what happens after the login too.
Help your team read a web address. A working MFA prompt on an unfamiliar page is still a risk. A short walkthrough of what these lures look like inside Microsoft 365 gives people permission to pause, check the address bar, and report it rather than push through because they’re busy.
Stop guarding only the front door
The businesses that shrink their AiTM risk are the ones that understand how sessions, tokens, and identity trust really fit together, and build controls around each layer instead of guarding the login screen alone. None of this needs enterprise overhead. It needs your identity setup configured properly and watched.
At Vaelis IT we help small businesses across the Northern Beaches and North Shore get this right, from proper Microsoft 365 setup through to the cybersecurity controls that catch a problem before staff ever feel it. If you’ve got MFA switched on but you’re not sure what happens after someone logs in, that’s exactly the gap worth closing.
Want a clear read on your identity controls before an incident finds the gaps for you? Book a free IT health check and we’ll walk through it with you, in plain English.