Man-in-the-middle attack
Also known as: MITM attack, MITM, adversary-in-the-middle, AiTM, on-path attack
A man-in-the-middle (MITM) attack, also called an adversary-in-the-middle attack, happens when an attacker secretly positions themselves between two parties, such as you and a website, so they can read or change the data passing between you.
It can happen on fake Wi-Fi hotspots, compromised routers, or through phishing proxies that capture logins and MFA codes in real time. While HTTPS has made classic eavesdropping much harder, phishing-based MITM attacks have become a common way to bypass multi-factor authentication.
Man-in-the-middle attack, explained at three levels
At home
Imagine passing notes to a friend through a classmate who secretly reads each one, maybe changes it, and passes it on. A man-in-the-middle attack does that to your internet traffic: the attacker sits between you and a website, often through a fake Wi-Fi hotspot or a fake login page that relays everything. HTTPS works like a sealed envelope, which is why it blocks most of these.
At work
A man-in-the-middle attack happens when an attacker secretly relays traffic between an employee and a real service, reading or changing it along the way. Today it most often uses a fake login page that passes everything to the real site, capturing the password, MFA code, and signed-in session. Businesses care because it can bypass ordinary MFA, which is why passkeys and security keys matter.
At home
In a man-in-the-middle attack, your traffic passes through the attacker on its way to the real website. On public Wi-Fi, they might create a network with the café's name, so your phone joins theirs. They can then read anything unencrypted and try to redirect you to fake pages. HTTPS protects you because the website proves its identity with a certificate, and your data is encrypted end to end, so the attacker in the middle sees only scrambled data.
At work
Classic local techniques include ARP spoofing, which tricks devices into sending traffic to the attacker's machine, rogue DHCP servers that hand out a malicious gateway or DNS server, and DNS hijacking. The more common modern form is adversary-in-the-middle phishing: kits such as Evilginx proxy the real login page, so the victim signs in to the genuine service through the attacker's server, which captures the password, the MFA code and the session cookie that follows.
At home
Your browser checks every HTTPS site's certificate. If an attacker in the middle tries to impersonate a site, the certificate will not match, and the browser shows a full-page warning that the connection is not private. Clicking past that warning hands the attacker exactly what they need. In my view, that warning is one of the few moments your browser is genuinely saving you, especially on public Wi-Fi, so treat it as a stop sign.
At work
Phishing-resistant MFA defeats adversary-in-the-middle phishing because FIDO2 and passkey signatures are bound to the real domain, so a proxy cannot reuse them. Add token protection or device-bound sessions, conditional access requiring compliant devices, and short session lifetimes. HSTS preloading stops downgrades to plain HTTP, and mobile apps can pin certificates. On local networks, DHCP snooping, dynamic ARP inspection and 802.1X port authentication block the classic techniques, and DNS over HTTPS or TLS protects name lookups.
Real-world examples
At home
Lena connected to 'Airport_Free_WiFi' while travelling. Her browser warned that a site's certificate wasn't valid, so she disconnected and used her phone's data instead.
At work
Thomas is security manager at a Montreal law firm. After an adversary-in-the-middle phishing attack stole an associate's session despite MFA, he moved the firm to passkeys for Microsoft 365.
How it compares
| feature | Man-in-the-middle attack | Phishing |
|---|---|---|
| Attacker position | Between you and the service | Tricks you into visiting a fake site |
| Can beat basic MFA | Yes, by relaying codes | Only if combined with MITM |
| Common setting | Fake Wi-Fi, phishing proxies | Email, text, social media |
| Strong defence | Passkeys and HTTPS | Awareness and filtering |
Modern MITM attacks often start as phishing and end by relaying your session.
For analysts
Because adversary-in-the-middle kits defeat code-based MFA, I'd prioritize passkeys or security keys for email and finance systems. It's the control that actually closes the gap.
History & origin
Interception attacks predate computers, but MITM became a networking concern as unencrypted protocols spread in the 1990s. Tools such as Ettercap, first released in 2001, made local network interception easy, and the 2010 Firesheep browser extension showed how easily logins could be hijacked on public Wi-Fi. In 2015, Lenovo was found to have shipped laptops with Superfish adware that installed its own root certificate, enabling MITM interception of HTTPS traffic. Widespread HTTPS adoption, HSTS, and certificate transparency reduced classic attacks. Attackers shifted to 'adversary-in-the-middle' phishing kits such as Evilginx, which proxy real login pages and steal session cookies. In my view, MITM is now less about sniffing Wi-Fi and more about fake login pages that relay everything you type.