cyber.hendryadrian.com
Interesting Stuff · huntress.com

How Adversary-in-the-Middle Attacks Steal Session Tokens

· Original article ↗

Summary

The article explains how adversary-in-the-middle attacks proxy login sessions to capture credentials and tokens, why stolen tokens can bypass MFA, and how phishing-resistant MFA and prompt session revocation can reduce risk.

Key points

  • AiTM attackers place a transparent proxy between a victim and a legitimate service, relaying the login while capturing credentials and session tokens.
  • A stolen session token can let an attacker access an account as the user without entering their username, password, or MFA code again.
  • The article distinguishes active token theft, including AiTM, from passive theft through breaches, credential dumps, or forums.
  • Evilginx, NakedPages, and Evilproxy are cited as tools or platforms used for AiTM attacks.
  • Phishing-resistant MFA can prevent token reuse by binding a session to a physical device; the article says adoption is low, especially among SMBs.
  • For suspected token theft, the article advises notifying someone who can invalidate the session and rotate credentials.

Article Details

Topic
Adversary-in-the-Middle attacks and session-token theft

MITRE ATT&CK

T1539 · Steal Web Session CookieThe article describes stealing session tokens to impersonate users and take over their authenticated sessions.T1557 · Adversary-in-the-MiddleAttackers proxy authentication traffic between victims and legitimate services to intercept credentials and session tokens.T1566 · PhishingThe article describes attackers deceiving victims into clicking links that lead to attacker-controlled proxy pages.

People

James O’LearyNamed as an author of the article about Adversary-in-the-Middle attacks.Matt KielyNamed as an author of the article about Adversary-in-the-Middle attacks.

Vendors

Huntressinvolves obtaining tokens by scouring data breaches, credential dumps, or shady forums. Internally at Huntress, we refer to these methods as "pickpocketing" for active theft and "dumpster diving" for passive theft.

Products

Microsoft 365 Apps for Enterpriseauthenticating through a transparent proxy that relays the authentication process to the legitimate Microsoft 365 service. Evilginx is the best-known AiTM toolkit, but many Phishing-as-a-Service (PhaaS) platforms,

Tools

Evilginxa transparent proxy that relays the authentication process to the legitimate Microsoft 365 service. Evilginx is the best-known AiTM toolkit, but many Phishing-as-a-Service (PhaaS) platforms, such as NakedPages andEvilProxythe best-known AiTM toolkit, but many Phishing-as-a-Service (PhaaS) platforms, such as NakedPages and Evilproxy, carry out similar attacks daily against small and medium-sized businesses (SMBs).NakedPagesEvilginx is the best-known AiTM toolkit, but many Phishing-as-a-Service (PhaaS) platforms, such as NakedPages and Evilproxy, carry out similar attacks daily against small and medium-sized businesses (SMBs).

Related Articles