Adversary-in-the-middle phishing
Adversary-in-the-middle phishing is a phishing technique in which an attacker relays a user's interaction with a legitimate sign-in service through an attacker-controlled intermediary to capture authentication material or session cookies.
A real sign-in through an attacker’s site
The attacker’s intermediary forwards the victim’s requests to the legitimate service and sends its responses back. The victim may complete a real authentication step while using the attacker’s site. In a campaign Microsoft reported in 2022, attackers captured passwords and session cookies, then used stolen cookies to access mailboxes.
A session cookie can keep a browser session authenticated. That is why a successful MFA check does not guarantee that the employee performed every later action in the session.
The MFA method matters
This technique does not defeat every form of MFA. NIST describes phishing-resistant protocols that bind authentication to the legitimate verifier or protected channel. To understand the protection in place, check the actual authentication method and the application’s session controls. “MFA enabled” does not tell you enough.
Investigating session theft
Keep the lure, timestamps, sign-in records, and application activity. Look for evidence of capture, attempted reuse, and accepted access; these are different stages.
The identity team can investigate the sign-in; the application owner needs to check activity under the resulting session. Coordinate containment across both so that revoking identity access is followed by a check that the suspect session no longer works.