Adversary-in-the-Middle Phishing and Evasion Techniques That Bypass MFA

Adversary-in-the-middle (AiTM) phishing continues to undermine traditional MFA by proxying legitimate Microsoft sign-in flows in real time, allowing attackers to capture not only passwords but also session tokens and MFA responses. One investigation described how sophisticated redirect infrastructure (e.g., unusually deep redirect chains) can place the final phishing content beyond the reach of many email security scanners, and how one-time URL tokens can prevent defenders from reproducing the full chain after the fact—making in-the-moment evidence collection critical. The same analysis emphasized that phishing-resistant MFA (e.g., FIDO2/passkeys) is a more effective control because hardware-bound credentials cannot be relayed through a proxy.

Operationally, defenders are being pushed to treat modern phishing as an infrastructure and workflow problem, not just a user-awareness issue: attackers increasingly use HTTPS, branded lookalike pages/domains, redirects, and short-lived links to evade detection, including QR phishing (codes embedded in PDFs that bypass URL scanning). Additional pressure tactics like MFA fatigue (push-spam) remain effective against push-based MFA, with mitigations including number matching, contextual prompts (e.g., location), and monitoring for abnormal push rates. For earlier detection of AiTM activity, one proposed tripwire is embedding Canary Tokens in Microsoft Entra ID tenant branding (e.g., custom CSS) to alert when an AiTM proxy loads the login page, while noting this is not universally reliable across all kits.