What is adversary-in-the-middle phishing?
Adversary-in-the-middle (AiTM) phishing is a phishing technique that defeats multifactor authentication not by breaking it but by relaying it. Instead of a static fake page that only captures a password, the attacker runs a proxy that sits between the victim and the genuine site, forwards everything in real time, and walks away with the authenticated session. It is the reason a user can do everything right, including approving a push, and still lose the account.
How the proxy works
The victim follows a link to a look-alike domain that is actually a reverse proxy. The proxy passes each request to the real site and returns the real responses, so the victim sees the authentic login and genuine MFA challenge. The victim enters the password and completes whatever second factor the genuine site demands. From that site's point of view a real user has signed in correctly. The proxy quietly keeps the authenticated session cookie the server returns and passes it along to the attacker. Loaded into the attacker's own browser, that cookie resumes a session already past login, so neither a password nor a new second-factor challenge is needed. Ready-made kits such as Evilginx automate the whole relay.
Why it is a replay at heart
The stolen session cookie is a valid token the attacker reuses, which makes this a form of session hijacking by replay. That also explains the indicators. The sign-in begins from a link; soon after, the identical session turns up from an unfamiliar device, address or location, and an impossible-travel alert fires against an account whose owner behaved normally.
How to defend against it
Codes and pushes do not help, because each produces something the proxy can forward. The durable answer is phishing-resistant MFA, meaning FIDO2 security keys or passkeys. These tie each credential to the genuine site's web origin, so a look-alike domain can never collect a response it is able to reuse. Beyond that, shorter session lifetimes, binding a session to its device, and conditional-access rules that react to new-device and impossible-travel signals reduce how much a stolen cookie is worth.
Adversary-in-the-middle phishing on the CompTIA Security+ exam
AiTM is both a phishing method and an MFA-bypass indicator under SY0-801 objective 2.5. The scenario marker is a login that started from an emailed link followed by account access from another location with no new MFA challenge, on a site that uses push or code MFA. The exam-correct fix is phishing-resistant FIDO2 or passkeys; number matching counters push bombing but not a relayed login, and a password reset alone may not end a session the attacker already holds.