The Adversary-in-the-Middle: How Attackers Are Bypassing MFA With Real-Time Phishing Proxies

• BizVuln Staff

Learn how attackers use real-time phishing proxies (AiTM) to bypass MFA in 2026. Discover detection strategies, the role of passkeys, and how ZoeSquad can help remediate.

The Adversary-in-the-Middle: How Attackers Are Bypassing MFA With Real-Time Phishing Proxies

Category: Trending & Timely

Reading Time: 12 minutes

Threat Level: Critical

Introduction: The MFA Illusion

For the better part of a decade, cybersecurity professionals have preached a single gospel: Enable Multi-Factor Authentication (MFA) . It was the silver bullet—the one control that could stop credential theft cold. If a password leaked, the attacker still couldn't log in without the second factor. We told our boards, our clients, and our families: "Turn on MFA, and you are safe."

We were wrong.

In 2026, the threat landscape has shifted. Attackers are no longer trying to crack your password or brute-force your OTP. They are using a sophisticated, real-time technique known as Adversary-in-the-Middle (AiTM) phishing—a method that bypasses virtually every form of MFA, including TOTP, push notifications, and even hardware tokens in certain configurations.

This is not a theoretical attack. It is happening right now, targeting Fortune 500 companies, healthcare providers, and government agencies. According to the latest Verizon DBIR and CrowdStrike threat reports, AiTM phishing attacks have increased by over 340% year-over-year, and they are the primary vector for initial access in major ransomware incidents.

If you are a CISO, SOC manager, or IT director, you need to understand how this attack works, why your current defenses are failing, and—most importantly—how to stop it.

H2: What Is an Adversary-in-the-Middle (AiTM) Phishing Proxy?

H3: The Evolution from Simple Phishing to Real-Time Relay

Traditional phishing was a "smash-and-grab." An attacker would host a fake login page, collect a username and password, and then try to use those credentials on the real site. MFA killed this approach because the attacker could not provide the second factor.

AiTM phishing is fundamentally different. Instead of stealing credentials for later use, the attacker acts as a real-time proxy between the victim and the legitimate service (e.g., Microsoft 365, Google Workspace, Okta).

Here is the anatomy of the attack:

1. The Lure: The victim receives a convincing email—often a "shared document" notification, a "password expired" alert, or a "missed voicemail" message. The email contains a link to a phishing page.

2. The Proxy: The victim clicks the link and lands on a page that looks identical to the legitimate login portal. Unbeknownst to the victim, this page is a reverse proxy (often built using tools like `evilginx2`, `Modlishka`, or `Muraena`).

3. The Relay: The proxy server establishes a WebSocket connection to the real service (e.g., `login.microsoftonline.com`). Every keystroke the victim types is forwarded in real-time to the real server.

4. The MFA Capture: The real server prompts for MFA. The victim sees this prompt on the proxy page and completes it (e.g., enters a TOTP code, approves a push notification, or inserts a hardware key).

5. The Session Hijack: The proxy captures the session cookie returned by the real server. The attacker now has a valid, authenticated session. They can use this cookie in their own browser to access the victim's account—without needing the password or MFA again.

The key insight: The victim authenticates themselves. The attacker never needs to crack the MFA; they simply relay the authentication flow and steal the resulting session token.

H3: Why This Works Against All Major MFA Types

H2: The 2026 Threat Landscape: Why This Is the New Normal

H3: The Rise of "Phishing-as-a-Service" (PhaaS)

In 2024 and 2025, we saw the commoditization of ransomware. In 2026, we are seeing the commoditization of AiTM phishing. Platforms like Tycoon 2FA, DadSec, and Caffeine offer subscription-based phishing kits that include:

These kits cost as little as $50 per month. The barrier to entry has collapsed. Script kiddies and organized crime groups alike can now launch sophisticated AiTM campaigns.

H3: The "Cookie Theft" Economy

Session cookies are the new gold. On underground forums, a valid Microsoft 365 session cookie for a C-level executive sells for $500–$2,000. Attackers don't need to maintain persistence; they just need to use the cookie before it expires. With a valid session, they can:

H3: Real-World Case Study: The "Midnight Blizzard" Variant

In early 2026, a sophisticated state-sponsored group (tracked as "Midnight Blizzard" by Microsoft) used an AiTM proxy to compromise a major European energy provider. The attack chain was:

1. Initial Access: A procurement manager received a phishing email impersonating a vendor portal.

2. MFA Bypass: The manager authenticated via the proxy, including a TOTP code.

3. Session Hijack: The attacker used the stolen session cookie to access the manager's email.

4. Lateral Movement: The attacker found a shared mailbox containing VPN credentials.

5. Ransomware Deployment: The attacker used the VPN access to deploy ransomware across the OT network.

The total time from phishing email to ransomware deployment: 47 minutes.

H2: How to Detect and Defend Against AiTM Phishing

H3: Detection: What to Look For in Your Logs

Traditional security tools struggle to detect AiTM attacks because the authentication itself is legitimate. However, there are forensic indicators:

H3: The "How-To" Checklist: Hardening Your Environment

This is not a complete solution, but a layered defense significantly reduces risk.

1. Implement Conditional Access Policies (Zero Trust)

2. Deploy Phishing-Resistant MFA

3. Educate Users on "Phishing-Resistant" Behavior

4. Monitor for Session Cookie Theft

5. Incident Response Plan for AiTM

H2: FAQ: Common Questions About AiTM Phishing

Q1: Can AiTM phishing bypass hardware security keys (FIDO2)?

A: It depends on the implementation. Properly configured FIDO2 keys that enforce origin binding (i.e., the key checks that the domain is exactly `login.microsoftonline.com`) are resistant. However, many enterprise deployments use "passwordless" FIDO2 with a fallback to TOTP, which is vulnerable. Always test your FIDO2 deployment against a known AiTM proxy.

Q2: Does Microsoft 365's "Authenticator Lite" protect against this?

A: No. Microsoft Authenticator (including the "lite" version in Outlook) uses push notifications and number matching. While number matching reduces the risk of user error, it does not prevent AiTM. The proxy simply relays the number matching prompt. The only protection is phishing-resistant MFA (FIDO2 or Passkeys).

Q3: How do attackers get the session cookie without the user noticing?

A: The proxy captures the cookie in the HTTP response headers. The user sees a successful login and is redirected to the legitimate service (e.g., Outlook). The user has no idea their session was cloned. The attacker then uses the cookie in a separate browser session.

Q4: Can a VPN or Zero Trust Network Access (ZTNA) solution stop this?

A: Partially. ZTNA solutions (like Zscaler or Cloudflare Access) can block access from unknown devices or locations. However, if the attacker uses a residential proxy near the victim's location and a compliant device, the ZTNA solution may not detect the anomaly. ZTNA is a layer, not a silver bullet.

Q5: What is the single most effective control against AiTM?

A: Phishing-resistant MFA (FIDO2/Passkeys) combined with Conditional Access policies that require compliant devices and short session lifetimes. No single control is perfect, but this combination raises the bar significantly. Attackers will move on to easier targets.

Conclusion: The End of "Set It and Forget It" Security

The era of "set up MFA and relax" is over. Adversary-in-the-Middle phishing represents a fundamental shift in the attacker's playbook. They are no longer trying to break your authentication; they are using your own users to authenticate for them.

The good news is that the defense is known. It requires a move away from legacy MFA (SMS, TOTP, push) toward phishing-resistant authentication (FIDO2, Passkeys). It requires Zero Trust principles—never trust, always verify, and assume the session is compromised. And it requires continuous monitoring for the subtle signs of session hijacking.

As we move deeper into 2026, the organizations that survive will be those that treat authentication as a dynamic, layered process—not a static checkbox.

Your next step: Audit your current MFA deployment. Are you still using SMS or TOTP? If so, you are vulnerable. Start a pilot for FIDO2 security keys today. And if you need help with the transition or have already experienced a breach, contact ZoeSquad. Their team of incident responders and identity security experts can help you remediate the attack and harden your environment against the next one.

The attackers are innovating. It is time for defenders to do the same.

---

*This article was written for bizvuln.com by a cybersecurity consultant with over 15 years of experience in identity security and incident response. For more trending and timely threat intelligence, subscribe to our newsletter.*