--- id: CP-004 slug: aitm-attack-mfa-token-theft lang: en title: AiTM attack and MFA token theft description: A fake sign-in site relays your password and MFA code live, then the attacker steals the session. How it works and how to protect yourself. canonical_url: https://startbrain.io/cyberpedia/en/articles/aitm-attack-mfa-token-theft/ markdown_url: https://startbrain.io/cyberpedia/en/articles/aitm-attack-mfa-token-theft.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "AiTM attack and MFA token theft", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/aitm-attack-mfa-token-theft/ (CC BY 4.0) wing: 1 theme: detect_phishing reflex: cr-004 schema: G1 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/aitm-attack-mfa-token-theft/ fr: https://startbrain.io/cyberpedia/fr/articles/attaque-aitm-vol-jeton-mfa/ de: https://startbrain.io/cyberpedia/de/articles/aitm-angriff-mfa-token-diebstahl/ es: https://startbrain.io/cyberpedia/es/articles/ataque-aitm-robo-token-mfa/ sources: - "n": 1 title: "From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud" publisher: Microsoft url: https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/ published: "2022-07-12" accessed: "2026-11-03" - "n": 2 title: "Use Alternate Authentication Material: Web Session Cookie, Sub-technique T1550.004 - Enterprise" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1550/004/ accessed: "2026-11-03" - "n": 3 title: Implementing Phishing-Resistant MFA publisher: CISA url: https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf accessed: "2026-11-03" - "n": 4 title: Passkeys (FIDO2) authentication method in Microsoft Entra ID publisher: Microsoft url: https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2 accessed: "2026-11-03" - "n": 5 title: Adversary-in-the-Middle, Technique T1557 - Enterprise publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1557/ accessed: "2026-11-03" - "n": 6 title: "Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1566/002/ accessed: "2026-11-03" - "n": 7 title: Steal Web Session Cookie, Technique T1539 - Enterprise publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1539/ accessed: "2026-11-03" - "n": 8 title: Multi-factor authentication for your corporate online services publisher: NCSC (UK) url: https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services published: "2024-09-26" accessed: "2026-11-03" --- # AiTM attack and MFA token theft You enter your password, approve the code from your authenticator app, and your mailbox opens as usual. Yet the sign-in page was fake. In an "adversary-in-the-middle" (AiTM) attack, a server placed between you and the real service passes everything along live, and the attacker keeps the proof of your sign-in along the way. That proof is the session cookie, the small file the service hands to the browser once identification succeeds. With it, the attacker enters your account without the service asking them for anything again. ## In 30 seconds - Where it happens: on a sign-in page for an online service (email, online office tools), reached from a link or an attachment received by email [1]. - What the attacker wants: the password and above all the session cookie, to sign in as you despite multifactor authentication (MFA) [1]. - The reflex: do not open the sign-in page from a message; use your bookmark or an address you type yourself, and report any message that sends you there. - If it has already happened: tell the IT department right away, because an attacker can act in the mailbox a few minutes after the theft [1]. ## Straight answers ### Doesn't MFA protect against account theft? It stops many threats. Microsoft writes that AiTM is not a flaw in MFA: because the session cookie is stolen, the attacker is authenticated in place of the user, whatever sign-in method the user has [1]. MITRE likewise notes that using a stolen session cookie bypasses some MFA protocols, since the session is already authenticated [2]. ### What does the booby-trapped page look like? Like the real one. The attacker's server relays each exchange to the imitated site: the page is visually identical to the original, and the address is the only visible difference [1]. If the organization has customized its Azure AD sign-in page, the fake page reproduces the same customization [1]. ### Is a six-digit code enough to protect me? No. CISA describes a common phishing technique: the message leads to a site that imitates a company's sign-in portal, and the user enters their username, password and the 6-digit code from their authenticator app there [3]. ### Which protection really holds up? FIDO2 keys and passkeys. Microsoft explains that they protect against verifier impersonation: the authenticator only releases its secrets to the service the key was registered with, not to an attacker posing as that service [4]. CISA lists FIDO/WebAuthn and public key infrastructure (PKI) based authentication among the phishing-resistant forms of MFA [3]. ## Inside the attacker's head The attacker does not have to build a fake site: they set up a web server that passes HTTP packets between the victim and the targeted service, in both directions [1]. The page contains two separate TLS sessions, one with the victim and one with the real site, which lets it extract passwords from the requests and, more importantly, session cookies [1]. This work can be automated with open source kits. Microsoft cites Evilginx2, Modlishka and Muraena [1]. MITRE specifies that Evilginx2 can serve as an AiTM relay between a legitimate site and a phished person to capture credentials, authentication tokens and session cookies [5]. Once the cookie is obtained, the attacker injects it into their own browser to skip authentication, even if the target's MFA is enabled [1]. ## What you see on screen It starts with a message. MITRE describes the email with a malicious link, which is used notably to avoid defenses that inspect attachments [6]. In the campaign studied by Microsoft, the email carried an HTML attachment and announced a voice message [1]. The page displayed a download bar for the message, but the bar was hard-coded in the file: no audio file was downloaded [1]. The victim was then redirected to a page that prefilled their email address, which made the trap more credible [1]. Then comes the sign-in page, a copy of the Microsoft portal. Once the credentials were entered and authentication succeeded, the victim landed on the real office.com page [1]. Nothing signals the interception: in the background, the attacker had already intercepted the credentials and opened a session in turn [1]. Here is a neutralized illustration of the form such an address takes, to show that only the address gives the trap away: ```text Illustration (neutralized address, invented for the example): hxxps://login[.]exemple-portail[.]invalid/[victim's identifier] Page displayed: [copy of the Microsoft sign-in form] Expected address: [the service's official address, typed or saved by you] ``` ## Under the hood A web service opens a session after authentication, so as not to ask for the user's identity again on every page. This session relies on a cookie supplied by the authentication service, which proves to the server that the user is signed in [1]. MITRE notes that these cookies often remain valid for a long time, even when the application is not actively used [7]. An attacker who has one can import it into a browser they control and sign in to the application [2]. In the 2022 campaign, the cookies carried an MFA claim: the attacker therefore used them to access the account despite the organization's MFA policy [1]. MITRE also cites a case where APT29 used stolen cookies to access cloud resources, and a forged duo-sid cookie to bypass MFA on an email account, during the SolarWinds compromise [2]. On the defense side, CISA ranks the forms of MFA from strongest to weakest. One-time codes from an app are vulnerable to phishing, as are SMS and voice calls [3]. Push notifications with number entry resist "push bombing" but not phishing [3]. Only FIDO/WebAuthn is, according to CISA, the widely available phishing-resistant authentication [3]. The UK's NCSC devotes a guide to the strongest MFA methods [8]. Microsoft also recommends conditional access policies, evaluated each time a stolen cookie is used (compliant device, trusted IP address) [1]. ## Case files ### July 2022: a campaign targeting more than 10,000 organizations On 12 July 2022, Microsoft published the analysis of a large-scale AiTM phishing campaign. It stole passwords, hijacked sessions and skipped authentication even when MFA was enabled. According to Microsoft's data, it attempted to target more than 10,000 organizations since September 2021 [1]. The attackers imitated the Office online authentication page, using the Evilginx2 kit [1]. ### After the theft: payment fraud The attackers then used the stolen credentials and cookies to access mailboxes and launch payment fraud (BEC) against other targets [1]. Microsoft observed that five minutes could be enough between the theft and the start of the fraud [1]. Over the following days, the attacker checked financial emails and attachments every few hours, looked for ongoing exchanges, then deleted the initial phishing email [1]. They then created an inbox rule that moved messages from the fraud target's domain to "Archive", marked as read, so that the account owner would see nothing [1]. Finally, they replied to threads about payments and invoices, then deleted their replies from the sent items [1]. On one occasion, they ran several attempts in parallel from the same mailbox [1]. ## Sources 1. Microsoft, "From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud", 12 July 2022. https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/ (accessed 3 November 2026) 2. MITRE ATT&CK, "Use Alternate Authentication Material: Web Session Cookie, Sub-technique T1550.004 - Enterprise". https://attack.mitre.org/techniques/T1550/004/ (accessed 3 November 2026) 3. CISA, "Implementing Phishing-Resistant MFA". https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf (accessed 3 November 2026) 4. Microsoft, "Passkeys (FIDO2) authentication method in Microsoft Entra ID". https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2 (accessed 3 November 2026) 5. MITRE ATT&CK, "Adversary-in-the-Middle, Technique T1557 - Enterprise". https://attack.mitre.org/techniques/T1557/ (accessed 3 November 2026) 6. MITRE ATT&CK, "Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise". https://attack.mitre.org/techniques/T1566/002/ (accessed 3 November 2026) 7. MITRE ATT&CK, "Steal Web Session Cookie, Technique T1539 - Enterprise". https://attack.mitre.org/techniques/T1539/ (accessed 3 November 2026) 8. NCSC (UK), "Multi-factor authentication for your corporate online services", 26 September 2024. https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/aitm-attack-mfa-token-theft/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.