Adversary-in-the-Middle (AiTM) is a phishing technique where the attacker sits between the victim and the real service, relaying traffic in real time. The user still reaches a legitimate login page, but the attacker can capture authentication artifacts such as session cookies or tokens after the password and MFA step are completed. That makes AiTM especially dangerous in cloud services, where a stolen session can be reused to impersonate the user without needing the password again.
In practice, AiTM kits are often used with fake sign-in pages that proxy Microsoft 365 or other SaaS logins. The goal is not to break MFA directly, but to steal the trusted session it creates. Defenders reduce risk with phishing-resistant MFA such as FIDO2 security keys or passkeys, strong conditional access policies, session revocation, and alerts for unusual sign-in behavior or reverse-proxy patterns.