When MFA Isn’t Enough: What Small Businesses Should Know About AiTM Phishing
You click a link, sign in, approve the MFA (multi-factor authentication) prompt, and get on with your day. What you don’t realize is that someone else just signed into your account at the same moment, from a completely different location.
That scenario catches a lot of business leaders and their staff off guard, especially the ones who rely on multifactor authentication to protect their cloud accounts. It’s also exactly how Adversary-in-the-Middle (AiTM) phishing attacks work.
These attacks don’t steal your password for later. They hijack the active session right after you’ve logged in.
Phishing Has Changed What It’s After
For years, phishing was about stealing usernames and passwords. MFA was the answer, but then attackers came up with new ways to circumvent MFA.
What’s changed is what attackers go after. Instead of credentials, they’re now targeting the session itself. The moment after a successful login, your browser holds a small piece of data called a session token. That token tells Microsoft 365 (or any other cloud service) that you’ve already proven who you are. No password prompt, no MFA challenge. Whoever holds the token has the access.
Modern phishing kits are built to intercept that token in real time.
How an AiTM Attack Actually Works
The fake login page isn’t really fake. It’s a live reverse proxy sitting between you and the real Microsoft sign-in page. Every keystroke and every server response flows through the attacker’s system as it happens.
From your perspective, nothing looks off. The branding is correct. The redirects work. The MFA prompt arrives on your phone like it always does. The only clue is usually a slightly altered URL, which is easy to miss on a phone or when you’re in a hurry.
Once you complete MFA, the legitimate service issues a session token, and the attacker quietly captures it. They import it into their own browser and pick up the session you just started. No login attempt of their own. No alert. No failed MFA prompt to investigate.
This is why standard sign-in logs often show nothing unusual after one of these attacks.
What Happens Next Is the Quiet Part
The dangerous thing about AiTM attacks is how ordinary the aftermath looks. The attacker is inside a real, authenticated session, so most monitoring tools see legitimate activity.
Research from Proofpoint and Microsoft has documented a consistent pattern of what attackers do once they’re in:
- They create hidden inbox rules that redirect or hide certain emails
- They register their own MFA method on the account to maintain access even after a password reset
- They watch email threads for financial conversations, wire transfer requests, or vendor invoices
- They use the compromised account to send phishing emails to colleagues, who are far more likely to trust them
This is why so many AiTM compromises are discovered late, usually after a fraudulent wire or a wider breach is already underway.
What Actually Reduces the Risk
MFA is still essential. We’re not suggesting otherwise. What we are saying is that MFA protects the moment of login. It doesn’t protect what happens after. Reducing AiTM risk means adding controls that look at the whole session, not just the front door.
Phishing-resistant MFA: FIDO2 security keys and passkeys are tied to a specific device and a specific legitimate domain. A proxy in the middle can’t relay them, because the authentication simply fails if the URL isn’t the real one. This is the single most effective control against AiTM attacks.
Conditional Access policies: Rules that evaluate device compliance, location, and session behavior can flag or block access when something looks off, even if the session token itself appears valid. This is built into Microsoft 365 Business Premium and worth taking the time to configure properly.
Post-login monitoring: Watching for new MFA method registrations, inbox rules created outside business hours, or sign-ins from unfamiliar locations tends to catch AiTM compromises faster than authentication logs alone.
User awareness on URLs: When your team understands that a working MFA prompt on an unfamiliar-looking page still represents a risk, they’re more likely to pause and check the URL before approving. A short walkthrough of what these lures look like in a Microsoft 365 context goes a long way.
MFA Is a Baseline, Not a Finish Line
The businesses that handle this well are the ones that understand how sessions and identity trust actually work. They build controls around each layer, not just the login screen.
If you’re not sure where your environment stands on this, that’s a reasonable conversation to have before something forces it. Reach out and we’ll walk through your identity security setup together.
Skyline IT Management helps small businesses make thoughtful technology decisions that lead to secure, resilient operations.
