Man-in-the-Middle (MitM) Attack: Types and Prevention

A man-in-the-middle (MitM) attack is a cyberattack where an attacker secretly places themselves between two parties, intercepting and sometimes altering the messages they exchange while both sides believe they are talking directly. The goal is to steal data such as logins and payment details, or to tamper with a transaction in transit.

Encryption has made this harder, but not impossible. More than 90% of web traffic now travels over encrypted HTTPS, according to Google's Transparency Report, so modern MitM attacks work around encryption rather than breaking it, exploiting rogue certificates, downgraded connections, and untrusted Wi-Fi.

How Does a Man-in-the-Middle Attack Work?

A man-in-the-middle attack succeeds by exploiting a weak point between two communicating parties: an unsecured Wi-Fi network, an outdated browser, a compromised email account, or a flaw in how certificates are trusted. 

The attacker uses that gap to slip into the conversation and relay traffic in real time, so neither side notices anything is wrong. The attack then plays out in two stages.

Stage 1: Interception

Interception is the act of getting into the middle of the traffic. The attacker reroutes the data between the victim and its destination through a machine they control, using tricks like a rogue Wi-Fi access point, poisoned address tables on a local network, or a redirected domain. The attacker then forwards each message to its real destination, so the exchange looks normal to both parties.

Stage 2: Decryption

Interception alone is rarely enough, because most traffic today is encrypted and appears as scrambled data. The attacker defeats that protection by downgrading a secure connection to plain HTTP, presenting a forged certificate the device trusts, stealing a logged-in session token, or planting malware in the browser. With the encryption neutralized, the attacker reads, records, and alters everything that passes.

Types of Man-in-the-Middle Attacks

MitM attacks take several forms, grouped by how the attacker gets in the middle.

Wi-Fi eavesdropping and evil twin

On public Wi-Fi, an attacker sets up a rogue access point, an “evil twin,” with a name that looks legitimate. Devices that connect route all their traffic through the attacker, who reads or alters it as it passes.

ARP spoofing

On a local network, ARP spoofing tricks devices into associating the attacker's machine with a legitimate IP address. The victim's traffic then flows through the attacker before reaching the router, a technique common on shared office and campus networks.

DNS spoofing

DNS spoofing, or DNS cache poisoning, corrupts the lookup that turns a domain name into an IP address. The victim types a real address but lands on the attacker's copy of the site, which harvests whatever they enter.

SSL stripping and HTTPS spoofing

SSL stripping quietly downgrades a secure HTTPS connection to plain HTTP, so the attacker reads traffic meant to stay encrypted. HTTPS spoofing goes further, presenting a fraudulent certificate that makes a fake site look genuine.

Session hijacking

Session hijacking steals the session cookie that a site issues after login. With that token, the attacker takes over the authenticated session without ever needing the password.

Man-in-the-browser

Man-in-the-browser attacks plant malware inside the victim's browser. The malware silently alters transactions, such as changing the destination account on a bank transfer, even over a legitimate HTTPS connection.

Email hijacking

Email hijacking targets the inbox rather than the network. After compromising or spoofing an email account, the attacker quietly monitors conversations and steps in at the right moment, often swapping bank details in an invoice thread to redirect a payment. This tactic drives many business email compromise scams, which cost organizations billions of dollars each year.

Adversary-in-the-Middle (AiTM): The Modern Evolution

The most common man-in-the-middle attack today taps no network at all. Adversary-in-the-middle (AiTM) phishing places a reverse proxy server between the victim and a legitimate login page, such as Microsoft 365 or Google Workspace. The victim signs in normally and completes multi-factor authentication, while the proxy relays every step to the real service and quietly steals the session cookie it issues.

That stolen cookie is the prize. Because it represents an already authenticated session, the attacker replays it to log in without a password or a second MFA prompt, defeating the very control most organizations rely on. Ready-made kits such as Evilginx, EvilProxy, and Tycoon 2FA have turned the technique into a subscription service, and Microsoft tracked a single campaign that targeted more than 10,000 organizations.

Standard defenses fall short here. A VPN encrypts the network but does nothing against a proxy the victim willingly visits, and app-based MFA codes are captured and replayed in real time. Only phishing-resistant methods, such as FIDO2 security keys and passkeys, reliably stop AiTM, because they tie authentication to the legitimate domain.

Real-World MitM Attack Examples

Two landmark cases show how MitM works at scale and why encryption alone is not enough.

Lenovo Superfish (2015). Lenovo shipped consumer laptops with preinstalled adware that inserted its own trusted root certificate to intercept HTTPS traffic and inject ads. Because the same key was reused across every machine, anyone on the same network could impersonate secure sites, a flaw serious enough for CISA to warn users to remove it.

DigiNotar (2011). Attackers breached the Dutch certificate authority DigiNotar and issued more than 500 fraudulent certificates for major domains, including Google. They used them to intercept the encrypted traffic of Iranian internet users and monitor their Gmail. The breach destroyed trust in DigiNotar, which went bankrupt within weeks.

How to Detect a Man-in-the-Middle Attack

MitM attacks are built to stay invisible, but a few warning signs give them away.

Watch for certificate warnings that the browser did not raise before, a site loading over HTTP instead of HTTPS, or repeated unexpected disconnections. Unusually slow connections on public Wi-Fi and unfamiliar network names are further red flags.

For organizations, the exposure often sits on the server side. Regular external vulnerability scanning flags the weak TLS settings, expired certificates, and missing security headers that let attackers downgrade or spoof a connection in the first place.

How to Prevent Man-in-the-Middle Attacks

Preventing MitM attacks comes down to encrypting traffic properly and verifying who is on the other end. Key measures include:

• Enforce HTTPS with HSTS. HTTP Strict Transport Security forces browsers to use HTTPS and blocks the downgrade attacks that SSL stripping relies on.
• Validate and pin certificates. Certificate validation and pinning reject forged or rogue certificates, even ones issued by a trusted authority.
• Use a VPN on untrusted networks. A VPN encrypts all traffic through a private tunnel, shielding it on public or shared Wi-Fi.
• Secure Wi-Fi with WPA3. Strong Wi-Fi encryption and avoiding open networks cut off evil-twin and eavesdropping attacks.
• Use encrypted DNS. DNS over HTTPS or TLS stops attackers from tampering with domain lookups.
• Enable multi-factor authentication. MFA limits the damage of a hijacked session or a stolen credential.

The OWASP Transport Layer Security guidance details how to configure TLS correctly.

Defend Against Man-in-the-Middle Attack with CloudSEK BeVigil

A MitM attack usually succeeds because of a weakness the target never noticed: an expired certificate, an outdated TLS version, or a subdomain missing HTTPS. Those gaps sit on the external attack surface, where they are easy to overlook and easy for an attacker to find.

CloudSEK's BeVigil continuously maps an organization's internet-facing assets and flags the conditions that enable interception, including weak or outdated TLS, expired and misconfigured certificates, missing HSTS, and DNS weaknesses. For the AiTM variant, CloudSEK's XVigil tracks the lookalike phishing domains and stolen session cookies behind those campaigns. Together they close the gaps a man-in-the-middle attack depends on before an attacker exploits them.

Frequently Asked Questions

Is a man-in-the-middle attack illegal?

Yes, man-in-the-middle attacks are illegal, because intercepting private communications without consent violates wiretapping and computer-fraud laws. Penalties rise sharply when the attack involves fraud or data theft.

Does HTTPS prevent man-in-the-middle attacks?

HTTPS blocks most man-in-the-middle attacks by encrypting traffic, but it is not absolute. Rogue certificate authorities, SSL stripping on sites without HSTS, and endpoint malware still bypass it in some cases.

Can a VPN prevent MitM attacks?

A VPN prevents most network-based MitM attacks by encrypting traffic through a private tunnel, which helps most on public Wi-Fi. It does not stop attacks that come from a rogue certificate or malware on the device itself.

What is the difference between a MitM attack and phishing?

A MitM attack intercepts real communication between two parties, while phishing tricks a victim into handing data to a fake site or message. MitM relies on interception; phishing relies on deception.

How common are man-in-the-middle attacks?

Classic network-based MitM attacks are relatively uncommon and often go unreported. Their modern form, adversary-in-the-middle phishing, is now widespread and drives many account-takeover campaigns.

What is the difference between a MitM attack and eavesdropping?

Eavesdropping passively listens to communication, while a man-in-the-middle attacker actively sits in the connection and alters what passes. All MitM involves eavesdropping, but not all eavesdropping is a MitM attack.