Adversary-in-the-Middle (AiTM) Phishing: How Attackers Bypass MFA and What Security Analysts Should Look For.

Phishing remains the single most reported form of cybercrime and one of the cheapest attacks to launch, yet among the most expensive to suffer. IBM (2025) estimates the average cost of a breach that begins with phishing at approximately USD 4.8 million, while the FBI's Internet Crime Complaint Centre recorded 191,561 phishing and spoofing complaints in 2025, more than double any other reported category (FBI IC3, 2026). For years, the standard advice to organisations has been simple: enable multi-factor authentication (MFA) and most phishing attacks will fail. In 2026, that assumption is being systematically dismantled.

A campaign disclosed by Infoblox Threat Intel in July 2026 illustrates why. Attackers targeted universities, enterprises, and multinational institutions, including agencies associated with the European Union and the United Nations using a technique known as adversary-in-the-middle (AiTM) phishing (Infoblox, 2026). Rather than stealing a password and hoping MFA is absent, the attacker positions themselves between the victim and the genuine login page, waits for authentication to complete, and then hijacks the authenticated session itself. This article explains how the technique works, examines the recent campaign as a case study, and outlines what security analysts and organisations should look for.

What Is Adversary-in-the-Middle Phishing?

In a traditional credential harvesting attack, the victim is lured to a fake login page that simply records their username and password. MFA defeats this: even with valid credentials, the attacker cannot supply the one-time code or approve the push notification.

AiTM phishing removes that obstacle. The victim is directed to a reverse proxy server controlled by the attacker, which relays every request and response between the victim and the legitimate identity provider (for example, Microsoft 365) in real time. The victim sees the genuine login flow, the real page content, the real MFA prompt and completes authentication successfully. The proxy, sitting invisibly in the middle, captures three things as they pass through: the credentials, the MFA exchange, and, critically, the session cookie issued once authentication succeeds (Infoblox, 2026). With that session token, the attacker can access the victim's account without needing the password or MFA at all, because the service already considers the session authenticated.

This capability is no longer the preserve of advanced actors. Commodity Phishing-as-a-Service (PhaaS) kits such as Evilginx, EvilProxy, FlowerStorm, and Kali365 package the entire reverse proxy workflow for paying subscribers, and Google (2026) notes that even after industry action against major kits such as Tycoon 2FA, attackers continue to mirror legitimate login flows to capture passwords and session cookies at scale.

Case Study: The 2026 Procurement Themed Campaign

The campaign documented by Infoblox researchers had been active since at least May 2026 and is notable less for its technology than for its social engineering. Instead of the familiar fear based lures account suspensions, password expiry warnings, the attackers exploited trust in routine business processes: procurement (Infoblox, 2026).

The attack chain unfolded in stages:

•      Delivery from trusted senders. Phishing emails were sent from previously compromised organisational mailboxes, meaning messages arrived from genuine internal or partner addresses and passed standard sender authentication checks (Intelligent CISO, 2026).

•      A credible pretext. Lures took the form of bid invitations, shared project files, or requests for information, reinforced with false deadlines and confidentiality language to create urgency (Intelligent CISO, 2026).

•      Fake document portals. Victims who clicked were routed through seemingly compromised small business websites to counterfeit document download portals, some gated behind CAPTCHA stages, a step that both adds legitimacy and frustrates automated security scanners (Mallory, 2026).

•      Cloned login pages. The portals impersonated well-known brands, including Microsoft and established contract platforms, presenting pixel accurate replicas of the real sign in experience (Infoblox, 2026).

•      Real time session theft. The AiTM proxy captured credentials, MFA authenticated tokens, and session cookies as victims logged in, granting the attackers authenticated access to Microsoft 365 resources such as Outlook and SharePoint (Mallory, 2026).

As Dr Renée Burton, Vice President of Infoblox Threat Intel, observed, the actors weaponised trust in organisational purchasing processes, a scenario that standard security awareness training rarely covers (Intelligent CISO, 2026). The goal, as the researchers framed it, was not merely access but authenticated trust: once inside a legitimate mailbox, the attacker can launch the next wave of the campaign from yet another trusted address, perpetuating the cycle.

Why This Matters for Defenders

AiTM campaigns undermine three assumptions that many organisations still rely on. First, that MFA is a near complete defence against phishing, it is not, when session tokens are stolen after authentication. Second, that email from known internal or partner addresses can be implicitly trusted, compromised mailboxes make sender reputation unreliable. Third, that URL reputation checks will catch malicious links, attackers deliberately route through freshly compromised legitimate websites and CAPTCHA gates precisely to defeat automated scanning (Infoblox, 2026).

What Analysts Should Look For

For SOC and incident response teams, several detection and response opportunities exist across the attack chain:

•      Impossible travel and anomalous sign ins. A stolen session token is typically replayed from attacker infrastructure. Sign in logs showing the same account authenticated from geographically distant locations within minutes, or from unfamiliar ISPs, hosting providers, or anonymising services, are a primary indicator.

•      Session anomalies after successful MFA. Alerts should not stop at failed logins. A successful, MFA satisfied login followed by unusual behaviour, mass mailbox rule creation, OAuth consent grants, bulk file access in SharePoint is the AiTM signature.

•      Suspicious inbox rules and forwarding. Attackers commonly create rules to hide their correspondence. New rules that delete or redirect messages containing terms such as "invoice", "payment", or "bid" warrant immediate investigation.

•      DNS and infrastructure signals. Because AiTM infrastructure is often stood up shortly before use, newly registered or newly observed domains, and lookalike domains referencing procurement or document sharing themes, can reveal campaigns upstream. Infoblox (2026) emphasises DNS based intelligence as a means of identifying campaign patterns before users ever reach a fraudulent page.

•      User reports as telemetry. Because the lures reference plausible business processes, staff in finance and procurement functions should be specifically briefed and given a low friction way to report suspicious bid or contract emails.

Mitigation Beyond Detection

Preventive controls can materially raise the cost of AiTM attacks. Phishing resistant authentication FIDO2 security keys and passkeys binds authentication to the legitimate origin, so credentials cannot be relayed through a proxy. Conditional access policies can require compliant or domain joined devices, rendering a stolen session token far less useful. Emerging protections such as token binding and device bound session credentials aim to make stolen cookies unusable from attacker infrastructure (Google, 2026). Finally, awareness training should be updated to include procurement and document-sharing pretexts, not only the traditional password-reset lure.

Conclusion

The 2026 procurement themed AiTM campaign is a reminder that phishing evolves in response to defences. MFA pushed attackers from stealing passwords to stealing sessions; sender authentication pushed them from spoofed addresses to genuinely compromised mailboxes; URL scanning pushed them behind CAPTCHAs and compromised legitimate sites. For junior analysts entering the field, the lesson is foundational: controls change attacker behaviour rather than ending it, and effective defence means monitoring what happens after authentication succeeds, not only before. Organisations that combine phishing resistant authentication, post login behavioural monitoring, and upstream infrastructure intelligence will be far better placed against this class of threat.

For further information and support, contact the International Association of Cybersecurity and Artificial Intelligence Professionals (IACAIP).

References

FBI Internet Crime Complaint Center (IC3) (2026) Internet Crime Report 2025. Federal Bureau of Investigation. Available at: https://www.ic3.gov (Accessed: 25 July 2026).

Google (2026) 'Google’s June 2026 frauds and scams advisory', The Keyword, 8 June. Available at: https://blog.google/innovation-and-ai/technology/safety-security/fraud-scams-advisory-june-2026/ (Accessed: 25 July 2026).

IBM (2025) Cost of a Data Breach Report 2025. IBM Security. Available at: https://www.ibm.com/reports/data-breach (Accessed: 25 July 2026).

Infoblox (2026) 'The Procurement Trap: Inside an AiTM Campaign Targeting Global Institutions', Infoblox Threat Intel Blog, 22 July. Available at: https://www.infoblox.com/blog/threat-intelligence/the-procurement-trap-inside-an-aitm-campaign-targeting-global-institutions/ (Accessed: 25 July 2026).

Intelligent CISO (2026) 'Phishing campaign targets global institutions with fake procurement emails', Intelligent CISO, 22 July. Available at: https://www.intelligentciso.com/2026/07/22/phishing-campaign-targets-global-institutions-with-fake-procurement-emails/ (Accessed: 25 July 2026).

Mallory (2026) 'Procurement-Themed AiTM Campaign Hijacks Microsoft 365 Sessions via Compromised Outlook Accounts', Mallory Security News, 21 July. Available at: https://mallory.ai/stories/019f864d-cd13-7094-9964-55c354477637 (Accessed: 25 July 2026).