Adversary-in-the-middle (AiTM) phishing is a technique where an attacker proxies a victim’s login between the user and the real service. The fake page forwards the credentials to the legitimate site in real time, then captures the resulting session cookie or token. That means the attacker may gain a usable session even if the password is changed later.
This matters because modern cloud accounts are often protected by MFA, but AiTM can still defeat weaker MFA by stealing the authenticated session instead of just the password. In real attacks, the stolen session can be used to read mail, search directories, or query services such as Microsoft Graph for staff tied to finance or payroll. Defenses include phishing-resistant MFA such as FIDO2 or passkeys, short-lived sessions, rapid token revocation, conditional access, and least-privilege permissions so a hijacked account cannot expose more data than necessary.