A man-in-the-middle attack (MitM) is an attack in which the adversary secretly positions themselves between two parties and reads or alters the traffic they exchange.
How MitM attacks work
To get “in the middle”, attackers use rogue Wi-Fi hotspots with familiar names, ARP spoofing in local networks, DNS spoofing, malicious proxies, compromised routers or fake mobile base stations. Once traffic passes through them, they can:
- read unencrypted data such as passwords sent over plain HTTP;
- downgrade connections (SSL stripping) or present fake certificates;
- inject malware into downloads or change payment details in emails.
A modern form is adversary-in-the-middle (AiTM) phishing: kits like Evilginx proxy a real login page, capture the password and the session cookie, and so bypass classic two-factor authentication.
Why MitM matters for security
Ubiquitous HTTPS has made passive eavesdropping much harder, so attackers now focus on stealing sessions through phishing proxies, on devices without certificate validation, IoT, and on users who click through certificate warnings. For companies, MitM on internal networks remains a path to credential theft and lateral movement.
How to defend
- Use HTTPS everywhere with HSTS; never ignore certificate warnings.
- Avoid open public Wi-Fi for sensitive work or use a trusted VPN.
- Switch to phishing-resistant MFA (FIDO2 security keys, passkeys), which binds the login to the real domain.
- In corporate networks enable DHCP snooping, dynamic ARP inspection and 802.1X.
