Attacks and malware
What is Adversary-in-the-middle?
An attacker secretly sitting between a user and a real service, relaying traffic so they can read it or steal session tokens.
In an adversary-in-the-middle attack, the attacker places themselves between the victim and a legitimate service and relays the traffic both ways. The victim sees the real site, but the attacker reads and can change everything in between.
Modern AitM phishing kits proxy the genuine login page. The victim enters their password and one-time code on the real service through the proxy, and the attacker captures the session cookie, which keeps working after the login.