A man-in-the-middle (MITM) attack is one in which an attacker secretly positions themselves between two communicating parties (a user and a website, for example) to intercept, eavesdrop on, or alter the data passing between them, often without either party realizing it. In the identity context, MITM is how attackers capture credentials, session tokens, and one-time codes in transit.

The "middle" position is the attack’s power: to both sides, the communication looks normal, while the attacker silently reads or manipulates everything flowing through.

How MITM attacks work

An attacker inserts themselves into the communication path through techniques like rogue Wi-Fi hotspots, DNS or ARP spoofing, or malicious proxies. In the modern identity-attack form (adversary-in-the-middle (AiTM) phishing) the attacker runs a reverse-proxy phishing site that sits between the victim and the real service. The victim enters credentials and even completes MFA on what looks like the genuine site; the proxy relays everything to the real service in real time and captures the resulting session. This is how MITM defeats traditional MFA.

Why MITM is dangerous for authentication

MITM undercuts the assumption that a secure login means a secure session. Because the attacker captures credentials and one-time codes as they’re transmitted (and increasingly the authenticated session token itself) even multi-factor authentication can be bypassed. The user believes they logged in securely; the attacker walks away with the keys. This is why MITM/AiTM has become a favored technique for account takeover against MFA-protected accounts.

How phishing-resistant authentication stops MITM

The strongest defense is authentication that can’t be relayed. Passkeys and FIDO2 are cryptographically bound to the legitimate site’s origin, so a proxy sitting on a different domain can’t produce a valid authentication, there’s no code to relay and the signature won’t validate for the wrong origin. This structurally defeats AiTM phishing, which is a core reason phishing-resistant authentication is considered the gold standard. Beyond authentication, encryption (HTTPS everywhere), certificate validation, avoiding untrusted networks, and detecting anomalous sessions all reduce MITM risk.

Where MITM attacks happen

MITM attacks thrive wherever communication can be intercepted. Public and unsecured Wi-Fi (cafés, airports, hotels) is a classic hunting ground, letting attackers position rogue hotspots or sniff traffic. Compromised routers and networks, DNS or ARP spoofing on a local network, and malicious browser extensions or proxies all provide the "middle" position. The modern, most damaging variant needs no local network access at all: adversary-in-the-middle phishing runs a reverse-proxy site anywhere on the internet, and the victim comes to it via a phishing link. That evolution matters because it means MITM is no longer confined to shared networks. It scales globally through phishing, which is why origin-bound, phishing-resistant authentication has become the essential defense rather than just "avoid public Wi-Fi."

Frequently asked questions

Where do man-in-the-middle attacks commonly occur?

On public or unsecured Wi-Fi, compromised networks, via DNS/ARP spoofing, and (most scalably) through adversary-in-the-middle phishing sites.

What is a man-in-the-middle attack?

An attack where a criminal secretly intercepts communication between two parties to eavesdrop on or alter it.

How does MITM defeat MFA?

Adversary-in-the-middle phishing proxies relay credentials and one-time codes in real time and steal the resulting session token.

How do you stop MITM attacks?

Phishing-resistant authentication (passkeys/FIDO2) that’s origin-bound, plus encryption, certificate validation, and session monitoring.

Related: Phishing · Session Hijacking · Passkeys · Multi-Factor Authentication (MFA) · Account Takeover (ATO)