How Adversary-in-the-Middle Phishing Attacks Sidestep MFA

Multi-factor authentication was designed to keep attackers out — but adversary-in-the-middle (AiTM) reverse proxy phishing attacks are engineered specifically to defeat it. In an AiTM attack, a malicious proxy server positions itself between the consumer and a legitimate website, capturing login credentials and one-time passcodes (OTPs) in real time and forwarding them to the real site before the token expires. Authentication is bypassed entirely.

Once inside, attackers can drain financial accounts, apply for credit or harvest personal data. Organizations that rely on MFA as their final line of defense are exposed.

Arkose Phishing Protection detects the reverse proxy infrastructure, domain signals and anomalous session characteristics associated with AiTM phishing campaigns and intervenes before account takeover occurs — without disrupting legitimate consumers. The infographic maps the full attack flow and shows where Arkose Phishing Ptorection breaks the chain.