AiTM (adversary-in-the-middle phishing)

security

Phishing that proxies the real site in real time: the fake page relays the victim's password and one-time code to the genuine service within their validity window, then steals the resulting session cookie.

It is why most deployed multi-factor authentication does not stop phishing. Codes, push approvals and authenticator apps all fail against it, because anything a person can read out and type can be relayed by someone else. Tooling for this is commodity rather than exotic. Only origin-bound credentials break the pattern, since the signature is tied to the site the browser is actually talking to - which is the argument for treating phishing-resistant authentication as a different category rather than a stronger grade of the same thing.

Also known as: adversary in the middle, reverse proxy phishing, session cookie theft, mfa bypass

← All glossary entries