thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Adversary-in-the-Middle Phishing (AiTM)

Phishing that proxies a real login session to steal both credentials and session cookies, bypassing traditional MFA.

Definition

Toolkits such as Evilginx and EvilProxy sit between the victim and the real service, relaying the login and MFA challenge and capturing the resulting session token. The attacker then replays the cookie to access the account. FIDO2 and certificate-based authentication resist it because they are bound to the origin.

Example

An Evilginx page relays a user's Okta login and captures the session cookie after MFA.

Exam tip

Push, SMS and TOTP MFA are vulnerable to AiTM; phishing-resistant MFA is the fix.

Related terms