An attacker-in-the-middle (AitM) attack occurs when an intruder places hardware or software in a communication path between two systems. From that position, the attacker may monitor, capture, block, or alter messages while the systems appear to communicate normally.
In cybersecurity, AitM attacks threaten the confidentiality and integrity of data. They can target network connections, device interfaces, or internal buses. For example, an implant connected to a maintenance interface could sit between avionics components and tamper with their messages. Defenses include controlling and inspecting physical access, securing maintenance ports, authenticating communications where possible, and monitoring for unexpected changes in traffic.