Cyberpediaby Brain
ENDEFR

AiTM attack and MFA token theft

A fake sign-in site relays your password and MFA code live, then the attacker steals the session. How it works and how to protect yourself.

In 30 seconds

Where it happens
On a sign-in page for an online service (email, online office tools), reached from a link or an attachment received by email1.
What the attacker wants
The password and above all the session cookie, to sign in as you despite multifactor authentication (MFA)1.
The reflex
Do not open the sign-in page from a message; use your bookmark or an address you type yourself, and report any message that sends you there.
If it has already happened
Tell the IT department right away, because an attacker can act in the mailbox a few minutes after the theft1.

What it is

You enter your password, approve the code from your authenticator app, and your mailbox opens as usual. Yet the sign-in page was fake. In an "adversary-in-the-middle" (AiTM) attack, a server placed between you and the real service passes everything along live, and the attacker keeps the proof of your sign-in along the way.

That proof is the session cookie, the small file the service hands to the browser once identification succeeds. With it, the attacker enters your account without the service asking them for anything again.

Straight answers

Doesn't MFA protect against account theft?

It stops many threats. Microsoft writes that AiTM is not a flaw in MFA: because the session cookie is stolen, the attacker is authenticated in place of the user, whatever sign-in method the user has1. MITRE likewise notes that using a stolen session cookie bypasses some MFA protocols, since the session is already authenticated2.

What does the booby-trapped page look like?

Like the real one. The attacker's server relays each exchange to the imitated site: the page is visually identical to the original, and the address is the only visible difference1. If the organization has customized its Azure AD sign-in page, the fake page reproduces the same customization1.

Is a six-digit code enough to protect me?

No. CISA describes a common phishing technique: the message leads to a site that imitates a company's sign-in portal, and the user enters their username, password and the 6-digit code from their authenticator app there3.

Which protection really holds up?

FIDO2 keys and passkeys. Microsoft explains that they protect against verifier impersonation: the authenticator only releases its secrets to the service the key was registered with, not to an attacker posing as that service4. CISA lists FIDO/WebAuthn and public key infrastructure (PKI) based authentication among the phishing-resistant forms of MFA3.

1Inside the attacker's head1 min

The attacker does not have to build a fake site: they set up a web server that passes HTTP packets between the victim and the targeted service, in both directions1. The page contains two separate TLS sessions, one with the victim and one with the real site, which lets it extract passwords from the requests and, more importantly, session cookies1.

This work can be automated with open source kits. Microsoft cites Evilginx2, Modlishka and Muraena1. MITRE specifies that Evilginx2 can serve as an AiTM relay between a legitimate site and a phished person to capture credentials, authentication tokens and session cookies5. Once the cookie is obtained, the attacker injects it into their own browser to skip authentication, even if the target's MFA is enabled1.

2What you see on screen1 min

It starts with a message. MITRE describes the email with a malicious link, which is used notably to avoid defenses that inspect attachments6. In the campaign studied by Microsoft, the email carried an HTML attachment and announced a voice message1. The page displayed a download bar for the message, but the bar was hard-coded in the file: no audio file was downloaded1. The victim was then redirected to a page that prefilled their email address, which made the trap more credible1.

Then comes the sign-in page, a copy of the Microsoft portal. Once the credentials were entered and authentication succeeded, the victim landed on the real office.com page1. Nothing signals the interception: in the background, the attacker had already intercepted the credentials and opened a session in turn1.

Here is a neutralized illustration of the form such an address takes, to show that only the address gives the trap away:

Excerpt
Illustration (neutralized address, invented for the example):
hxxps://login[.]exemple-portail[.]invalid/[victim's identifier]
Page displayed: [copy of the Microsoft sign-in form]
Expected address: [the service's official address, typed or saved by you]
3Under the hoodIT teams1 min

A web service opens a session after authentication, so as not to ask for the user's identity again on every page. This session relies on a cookie supplied by the authentication service, which proves to the server that the user is signed in1. MITRE notes that these cookies often remain valid for a long time, even when the application is not actively used7. An attacker who has one can import it into a browser they control and sign in to the application2.

In the 2022 campaign, the cookies carried an MFA claim: the attacker therefore used them to access the account despite the organization's MFA policy1. MITRE also cites a case where APT29 used stolen cookies to access cloud resources, and a forged duo-sid cookie to bypass MFA on an email account, during the SolarWinds compromise2.

On the defense side, CISA ranks the forms of MFA from strongest to weakest. One-time codes from an app are vulnerable to phishing, as are SMS and voice calls3. Push notifications with number entry resist "push bombing" but not phishing3. Only FIDO/WebAuthn is, according to CISA, the widely available phishing-resistant authentication3. The UK's NCSC devotes a guide to the strongest MFA methods8. Microsoft also recommends conditional access policies, evaluated each time a stolen cookie is used (compliant device, trusted IP address)1.

4Case filesReal cases1 min

July 2022: a campaign targeting more than 10,000 organizations

On 12 July 2022, Microsoft published the analysis of a large-scale AiTM phishing campaign. It stole passwords, hijacked sessions and skipped authentication even when MFA was enabled. According to Microsoft's data, it attempted to target more than 10,000 organizations since September 20211. The attackers imitated the Office online authentication page, using the Evilginx2 kit1.

After the theft: payment fraud

The attackers then used the stolen credentials and cookies to access mailboxes and launch payment fraud (BEC) against other targets1. Microsoft observed that five minutes could be enough between the theft and the start of the fraud1. Over the following days, the attacker checked financial emails and attachments every few hours, looked for ongoing exchanges, then deleted the initial phishing email1.

They then created an inbox rule that moved messages from the fraud target's domain to "Archive", marked as read, so that the account owner would see nothing1. Finally, they replied to threads about payments and invoices, then deleted their replies from the sent items1. On one occasion, they ran several attempts in parallel from the same mailbox1.

Fact sheet

Identifier
CP-004
Wing
1. Attacks and techniques
Brain skill
Detecting Phishing (detect_phishing)
Brain reflex
cr-004
Diagram
G1 · Attack vs Defense Chain
Languages
de, en, fr
Sources
8 sources checked on 3 November 2026
Sources8 sources
  1. Microsoft, “From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud”, 12 July 2022. https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/ (accessed 3 November 2026)
  2. MITRE ATT&CK, “Use Alternate Authentication Material: Web Session Cookie, Sub-technique T1550.004 - Enterprise”. https://attack.mitre.org/techniques/T1550/004/ (accessed 3 November 2026)
  3. CISA, “Implementing Phishing-Resistant MFA”. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf (accessed 3 November 2026)
  4. Microsoft, “Passkeys (FIDO2) authentication method in Microsoft Entra ID”. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-passkeys-fido2 (accessed 3 November 2026)
  5. MITRE ATT&CK, “Adversary-in-the-Middle, Technique T1557 - Enterprise”. https://attack.mitre.org/techniques/T1557/ (accessed 3 November 2026)
  6. MITRE ATT&CK, “Phishing: Spearphishing Link, Sub-technique T1566.002 - Enterprise”. https://attack.mitre.org/techniques/T1566/002/ (accessed 3 November 2026)
  7. MITRE ATT&CK, “Steal Web Session Cookie, Technique T1539 - Enterprise”. https://attack.mitre.org/techniques/T1539/ (accessed 3 November 2026)
  8. NCSC (UK), “Multi-factor authentication for your corporate online services”, 26 September 2024. https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services (accessed 3 November 2026)

Cite this article

Brain, “AiTM attack and MFA token theft”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/aitm-attack-mfa-token-theft/

BibTeX 
@misc{brain_cp004_en_2026,
  author = {Brain},
  title = {AiTM attack and MFA token theft},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/aitm-attack-mfa-token-theft/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence