What Is a Man-in-the-Middle Attack and How Can You Prevent It?

Man-in-the-Middle Attack Definition

A man-in-the-middle attack is when someone secretly slips into the middle of a conversation between two parties, say you and your bank’s website. Each side thinks it is talking straight to the other, but every message now passes through the attacker first. That position lets them read what is being sent and change it before it reaches the other end. 

The term covers two generations of the same idea. A classic man-in-the-middle attack works at the network or transport layer. It reads raw traffic on an open Wi-Fi network, poisons ARP tables on a local network, or strips HTTPS down to plain HTTP. Widespread encryption shut down most of this, so attackers moved further up the stack.

Its modern successor, the adversary-in-the-middle (AiTM) attack, works at the authentication layer. Instead of intercepting packets, it puts a reverse proxy between the victim and a real login page. The victim logs in normally and completes multi-factor authentication. On the other side, the proxy captures the live session token the identity provider issues. The attacker replays that token to reach the account without ever knowing the password or the one-time code.

The table below compares the classic and modern variants across four dimensions.

Man-in-the-Middle Attacks in 2026: What Group-IB Sees

The center of gravity for man-in-the-middle activity has shifted from cable tapping and Wi-Fi sniffing to identity theft. Group-IB’s High-Tech Crime Trends Report 2026 describes identity and trust as the primary attack surfaces, as industrialized cybercrime shifts focus from breaking the perimeter to hijacking legitimate sessions. Reverse-proxy phishing kits are the engine behind that shift.

These kits are sold as phishing-as-a-service, which means an operator with little skill can run an adversary-in-the-middle campaign against Microsoft 365 or Google Workspace and collect authenticated session cookies at scale. 

Group-IB Threat Intelligence tracks the infrastructure behind these operations, so defenders can block proxy domains and sender patterns before a lure reaches a user. You can read the full picture in the High-Tech Crime Trends Report 2026.

How a Man-in-the-Middle Attack Works

A man-in-the-middle attack follows four stages. The attacker first moves into the path of the traffic, then reads and relays it, modifies what is useful, and remains hidden so the session appears normal to both sides. We will look at each stage below.

Intercepting the communication channel

The attack begins when the attacker positions themselves between the victim and the service. On a local network, this can happen through a rogue access point or address spoofing. In an adversary-in-the-middle campaign, a phishing link redirects the victim to a reverse proxy rather than the real login page.

Capturing and relaying data

Once in the middle, the attacker records everything that passes and forwards it so the conversation continues normally. Passwords, one-time codes, and cookies all flow through the attacker. When the identity provider issues a session cookie, the attacker copies and replays it, a form of session hijacking that grants access without the password or the second factor.

Manipulating information in transit

Interception often turns into manipulation. An attacker can change payment details, swap a download for malware, or inject content into a page. Because the attacker controls the channel, both parties still see what appears to be a legitimate exchange.

Maintaining a hidden presence

The attack works only if it stays invisible. Attackers proxy real responses, mirror valid certificates where they can, and keep latency low so nothing feels off. A stolen session cookie is especially quiet, since the attacker reuses an already trusted session rather than triggering a new login alert.

Types of Man-in-the-Middle (MITM) Attacks

Man-in-the-middle attacks take several forms, grouped by the layer they abuse. The five below cover the techniques that appear most often in real incidents, from wireless interception to stripping encryption off a connection.

Wi-Fi eavesdropping attacks

An attacker sets up a rogue hotspot or joins an unsecured network to read the traffic that passes through it. Public Wi-Fi in cafes, airports, and hotels is a common setting because users connect without checking what they are joining. Any unencrypted request on that network is readable.

ARP spoofing

Address Resolution Protocol spoofing allows an attacker to associate their own device with a legitimate IP address on a local network. Devices then send traffic meant for the gateway to the attacker instead. This gives the attacker a quiet seat in the middle of local traffic.

DNS spoofing

Domain Name System spoofing corrupts the lookup process that maps a domain name to an IP address. The victim types the correct address but is redirected to a server controlled by the attacker. The 2011 DigiNotar case, covered below, paired this technique with fraudulent certificates.

IP spoofing

Internet Protocol spoofing forges the source address of packets so they appear to come from a trusted host. The target accepts the traffic and may route responses back through the attacker. It is often a building block for larger interception or redirection.

HTTPS stripping

HTTPS stripping downgrades a secure connection to plain HTTP without the user noticing. The attacker keeps an encrypted link to the real site and serves the victim an unencrypted one that reads everything in clear text. Sites that enforce HTTP Strict Transport Security are much harder to strip.

Examples of Man-in-the-Middle Attacks

Real cases show how the technique evolved from network interception to session theft. Each man-in-the-middle attack example below marks a different layer of the problem.

One well-documented man-in-the-middle attack example is the 2011 DigiNotar breach. An intruder compromised the Dutch certificate authority and issued fraudulent certificates for Google and other domains, which were then used with DNS redirection to intercept Gmail traffic inside Iran. 

According to the Electronic Frontier Foundation, around 300,000 IP addresses had their connections exposed, and the incident prompted browser makers to adopt certificate pinning and transparency logs.

A second example moved the problem to the endpoint. In 2015, Lenovo consumer laptops shipped with Superfish adware that installed a self-signed root certificate and re-signed HTTPS traffic to inject ads. 

The United States Cybersecurity and Infrastructure Security Agency advised users to remove the software and the certificate because the shared private key lets attackers intercept encrypted sessions.

How to Detect a Man-in-the-Middle Attack

Detection relies on monitoring the traces that interception leaves in traffic, certificates, devices, and sign-in behavior. Detecting a man-in-the-middle attack in cybersecurity now depends as much on identity signals as on packet inspection. 

The six checks below provide practical SOC coverage.

Monitor network traffic anomalies

Baselining normal flows makes unusual relays and redirections stand out. Sudden latency changes, duplicate ARP replies, or traffic taking an unexpected hop can all indicate interception. Network Traffic Analysis surfaces these deviations and flags command-and-control patterns hidden inside encrypted sessions.

Inspect SSL/TLS certificates

Certificate anomalies are one of the strongest interception signals. Watch for issuers that do not match the expected authority, certificates that appear only for some users, or unexpected self-signed roots on managed devices. A mismatch between the certificate a user sees and the one the site actually serves is a red flag.

Identify unauthorized devices

Rogue access points and unknown hosts on the local network are classic tools for interception. Maintain an inventory of approved devices and be alerted to new hardware that inserts itself into the path between users and the gateway. Wireless scans help spot access points that impersonate the corporate network.

Detect suspicious DNS activity

Because DNS redirection underpins many attacks, watch resolver logs for answers that point trusted domains to unfamiliar IP addresses. Spikes in failed lookups or sudden changes in resolution for a known domain deserve investigation. DNS monitoring often catches redirection before a user reaches the fake site.

Analyze user authentication events

Session theft shows up in authentication logs rather than network captures. Look for sign-ins from two distant locations within an impossible time window, a session that continues on a new device midstream, or a token used from a hosting provider’s address. These patterns often reveal an adversary-in-the-middle compromise after the fact.

Detection signatures and IoCs from Group-IB DFIR

Group-IB’s digital forensics and incident response engagements produce concrete indicators of compromise for reverse-proxy kits. The table below lists signals analysts watch for and what each one usually means.

Threat Actors and Campaigns Using MITM Techniques

Modern man-in-the-middle activity is dominated by phishing-as-a-service operators who rent adversary-in-the-middle kits to anyone willing to pay. These kits automate reverse proxying, template login pages for major identity providers, and harvest tokens via channels like Telegram. Skill is no longer the barrier it once was.

Tycoon FA is the clearest example, targeting Microsoft 365 tenants across financial services, healthcare, government, and technology. Because most of these campaigns start with an email lure, inbox-level controls such as Business Email Protection matter for cutting the chain early. 

Group-IB Threat Intelligence profiles the operators behind these campaigns and maps their infrastructure in the MITRE ATT&CK format, which helps a SOC block proxy domains and correlate sender patterns before the next wave lands.

How to Prevent Man-in-the-Middle Attacks

Man-in-the-middle attack prevention works in layers. No single control stops every variant, so combine encryption, strong authentication, network hygiene, and access rules that assume a session could be hijacked. 

The five practices below give the most coverage for the effort.

Use end-to-end encryption

Encrypting data end-to-end means an intercepted stream is unreadable without the keys. Enforce HTTPS across your web properties with HTTP Strict Transport Security so connections cannot be silently downgraded. For messaging and file transfer, choose tools that encrypt content between endpoints rather than only in transit to a server.

Enforce multi-factor authentication

Strong authentication raises the cost of stolen passwords, but the type matters against adversary-in-the-middle attacks. Standard Multi-Factor Authentication (MFA) using one-time codes or push prompts can be relayed through a proxy in real time. Phishing-resistant methods bound to the domain, such as FIDO2 security keys and passkeys, break the proxy because the credentials refuse to authenticate to a lookalike site.

Secure wireless networks

Wireless is where classic interception still thrives. Use WPA3 on corporate networks, disable open guest access to sensitive segments, and warn staff against sending business data over untrusted public Wi-Fi. Rogue access point detection closes the gap that eavesdropping attacks rely on.

Implement Zero Trust security controls

Zero Trust assumes that any session could be compromised and continuously verifies. Pair conditional access with strong Identity and Access Management (IAM) so access depends on device health, location, and behavior rather than a single login. Least-privilege permissions limit what a hijacked session can reach.

Use VPNs on untrusted networks

A virtual private network wraps traffic in an encrypted tunnel, which protects users on networks you do not control. This is most valuable for remote and traveling staff who rely on public connections. A VPN does not stop a phishing proxy, so treat it as one layer rather than a complete answer.

Types of Industries and Personas That Are Most Vulnerable to MITM Attacks

Some organizations and roles draw more man-in-the-middle activity because of the accounts and data they hold. Financial services, healthcare, government, and technology firms sit near the top, and within them, a few roles carry outsized risk. 

The table below maps the most exposed profiles.

For a SOC, the practical takeaway is to weight monitoring toward these accounts, since a single hijacked administrator or finance session can unlock a large part of the environment.

Best Practices for Organizations

An effective man-in-the-middle attack prevention approach treats the session token as the asset attackers most want and builds controls to protect and monitor it. The practices below turn the layers above into a repeatable program.

• Roll out phishing-resistant authentication for privileged and high-value accounts first, then expand.
• Monitor authentication logs for impossible travel, new device fingerprints, and tokens replayed from hosting ranges.
• Filter lures at the inbox, since email delivers most adversary-in-the-middle campaigns.
• Take down lookalike and typosquatting domains that host phishing proxies before they scale.
• Test your response with tabletop exercises so a hijacked session is contained in hours, not days.

Detect and Prevent MITM Attacks With Group-IB

Stopping a man-in-the-middle attack early means catching the lure and the infrastructure, not just the theft of the final session. Group-IB Business Email Protection detects and blocks phishing and adversary-in-the-middle lures that initiate most modern chains before they reach the inbox.

Group-IB Threat Intelligence maps the proxy domains, kits, and operators behind those campaigns, so your team can block known-bad infrastructure and prioritize response against the actors that target you. 

Request a demo of Group-IB Threat Intelligence to see attacker infrastructure mapped to your risk profile, and book a Business Email Protection assessment to test detection against live adversary-in-the-middle lures.