HTTPS interception is the act of inspecting or altering encrypted web traffic between a client and a server. Because HTTPS is designed to protect confidentiality and server identity, interception usually depends on controlling trust on the endpoint or network: for example, by installing a rogue root certificate, abusing a local proxy, or otherwise convincing the browser or application to trust a man-in-the-middle.
This matters because it can expose credentials, session cookies, and other sensitive data that would normally stay encrypted in transit. Attackers use it in malware that steals browser logins, rewrites pages, or captures API requests after decrypting them locally. Defenders also use similar techniques in approved security tools such as enterprise web proxies and TLS inspection appliances, but those deployments should be tightly managed and visible. Unexpected certificate prompts, new trusted roots, or forced proxy settings are common signs that HTTPS interception may be happening outside policy.