Adversary-in-the-Middle

Adversary-in-the-Middle: An attack in which an actor positions themselves between two communicating parties. The term describes an attack methodAttack MethodA defined way in which an attacker attempts to compromise a target or achieve an objective., malicious componentMalicious ComponentCode, content, or infrastructure that performs or supports malicious activity., or threat scenarioThreat ScenarioA plausible sequence of events describing how a threat could affect an organization or system.. Protection requires a combination of preventionPreventionMeasures intended to stop security incidents or attacks before they occur., detectionDetectionThe capability to identify suspicious activity, attacks, or policy violations in time., containmentContainmentActions that limit the scope, spread, and impact of an active security incident., recoveryRecoveryThe controlled restoration of systems, data, and business services after a disruption., and awareness-raising.

Frameworks such as EvilginxEvilginxOpen-source adversary-in-the-middle phishing framework that proxies login traffic and can capture credentials and session cookies. demonstrate in authorized tests how proxied login flows can expose session cookies even after an MFA check.

How it works and where it fits

Technically, Adversary-in-the-Middle describes an attack path or a concrete method rather than a single suspicious event. A sound assessment separates prerequisites, entry point, objective, intermediate steps, and expected effect. The same technique can produce very different outcomes depending on system architecture, available privileges, exposure, and existing safeguards.

Practical security relevance

In practice, both preventive measures and observable traces matter. Secure configuration, restricted privileges, robust input and identity checks, and telemetry at affected trust boundaries all contribute. A single indicator rarely proves an attack; reliable detection, containment, and remediation require the combined context of timing, source, target, and observed impact.

Related concepts

• Transport Layer SecurityTransport Layer SecurityProtects network connections through encryption, authentication, and integrity checks.: Protects network connections through encryption, authentication, and integrity checks.
• Certificate PinningCertificate PinningSpecification of expected certificates or public keys for a connection.: Specification of expected certificates or public keys for a connection.
• AuthenticationAuthenticationVerification of the claimed identity of a user or system.: Verification of the claimed identity of a user or system.
• ARP SpoofingARP SpoofingManipulation of ARP mappings to redirect or intercept network traffic.: Manipulation of ARP mappings to redirect or intercept network traffic.