An adversary-in-the-middle (AiTM) attack is one where an attacker positions themselves between two communicating parties to read or change the data passing between them. MITRE ATT&CK describes it as a technique that supports follow-on behaviors such as network sniffing and data manipulation.
- Also Called3other namesAiTM · man-in-the-middle · MitM
- Related Terms3linked entriesPhishing · Session cookie
- Read Next1guide on the same topicPhishing 101
What is an adversary-in-the-middle attack?
An adversary-in-the-middle (AiTM) attack is one where an attacker sits between two parties that are talking to each other. The attacker can then read or change what passes between them. MITRE ATT&CK describes this as adversaries positioning themselves between networked devices to support follow-on behaviors such as network sniffing and data manipulation.
How does an AiTM attack work?
MITRE says adversaries can abuse networking protocols such as ARP, DNS and LLMNR to make devices send their traffic through systems the adversary controls. MITRE also says this can involve DNS manipulation to redirect users, or downgrading encryption protocols. From that position, the attacker may monitor or change traffic.
- Name resolution poisoning and SMB relayT1557.001
- ARP cache poisoningT1557.002
- DHCP spoofingT1557.003
- Evil twinT1557.004
NIST defines the older term, man-in-the-middle attack, as an attack where an attacker is positioned between two communicating parties to intercept and/or alter data traveling between them. NIST notes this also covers the case where the attacker sits between a claimant and a verifier during authentication.
What can an attacker take?
MITRE says AiTM can enable credential theft, including access tokens and session cookies. A session cookie is a small piece of data a website gives your browser after you sign in, so the site knows it is still you. Because of this, AiTM can matter even when a person has entered a correct password, since stolen tokens and cookies are not the password itself.
A simple illustration
This is a generic illustration only. A user is sent to a fake website that passes their sign-in through to the real one. The user sees a normal page, but the attacker sits in the path and can see what is exchanged.
How can AiTM be detected or reduced?
MITRE lists several mitigations. It says to ensure that all wired and wireless traffic is encrypted appropriately. It also lists disabling legacy network protocols, filtering network traffic and segmenting networks. It suggests network intrusion prevention systems to identify traffic patterns indicative of AiTM activity, and training users to recognize certificate errors.
For detection, MITRE points to suspicious configuration changes and network anomalies. These include unauthorized DNS or ARP changes, unexpected TLS downgrades, changes to certificate trust, and abnormal routing patterns.
On sign-in, CISA says that when a malicious actor tricks a user into logging into a fake website, the FIDO protocol will block the attempt. CISA also says FIDO/WebAuthn is the only widely available phishing-resistant authentication, and that using any multi-factor authentication improves security compared with passwords alone.
Is AiTM the same as man-in-the-middle?
The ideas are the same. MITRE uses the name adversary-in-the-middle for the technique, and NIST defines man-in-the-middle attack. Both describe an attacker placed between two communicating parties.
Is AiTM the same as phishing?
No. Phishing is a way of tricking a person. AiTM is about the attacker sitting in the path of the traffic. The two can be used together, as in the fake website illustration above, but they are separate terms.
Does multi-factor authentication stop AiTM?
CISA says not all multi-factor methods give equal protection, and it points to FIDO/WebAuthn as phishing-resistant. Related terms are multi-factor authentication, phishing and session cookies.
MITRE lists the technique as T1557. The older name, man-in-the-middle attack (MitM), is the one NIST uses, and this page covers both.
See also
Also Called.
- NameAiTM
- Nameman-in-the-middle
- NameMitM
Questions.
-
What is an adversary-in-the-middle attack?
An adversary-in-the-middle (AiTM) attack is one where an attacker sits between two parties that are talking to each other. The attacker can then read or change what passes between them.
-
How does an AiTM attack work?
MITRE says adversaries can abuse protocols such as ARP, DNS and LLMNR to make devices send traffic through systems they control. This can also involve DNS manipulation or downgrading encryption. From that position the attacker may monitor or change traffic.
-
What can an attacker steal with AiTM?
MITRE says AiTM can enable credential theft, including access tokens and session cookies. It can matter even when a person has entered a correct password, since stolen tokens and cookies are not the password itself.
-
Is AiTM the same as man-in-the-middle?
The ideas are the same. MITRE uses the name adversary-in-the-middle for the technique, and NIST defines a man-in-the-middle attack. Both describe an attacker placed between two communicating parties.
Sources
In Our Research
- 1 ENISA 2026: ClickFix, Smishing and Phishing Kit Trends October 2026
- 2 Phishing-as-a-Service 2.0: The Kits That Bypass MFA Without a Fake Login Page August 2026
- 3 Device-Code Phishing: The MFA Bypass Method Nobody’s Training Employees On August 2026
- 4 How Spear Phishing Campaigns Target C-Suite Executives: Tactics, Tools, and Defense July 2026
- 5 Expired SSL Certificates: How a Lapsed Cert Becomes an Attack Vector July 2026
- 6 How Attackers Use Stolen Credentials: The Complete Account Takeover Lifecycle June 2026