Adversary-in-the-middle token compromise
Phishing operations increasingly target session tokens and authenticated workflows to bypass password-focused controls.
- Momentum score
- 65
- Impact
- High
- Confidence
- High
What it is
An adversary-in-the-middle phishing site relays traffic between a victim and the real sign-in service, capturing credentials and the authenticated session token produced after multifactor authentication. The attacker can then reuse that token to enter the account without repeating the login. The technique grew out of reverse-proxy phishing and has become easier to operate through packaged phishing services and automated delivery chains.
Why it is rising
Microsoft's Q2 reporting emphasized AiTM token compromise alongside changing phishing delivery techniques.
Six-month trajectory
Normalized weekly momentum for prototype validation
+10 over 4 weeks
Marketing implications
High-level suggestions for buyer education. These are not claims that a product would have prevented a reported incident.
- 01Shift buyer education from password theft to session integrity.
- 02Explain why phishing-resistant authentication and token monitoring solve different layers.
- 03Offer practical guidance for revoking and investigating suspicious sessions.