Business Email Compromise Attack Mechanics

Adversary-in-the-Middle (AiTM) attack

An Adversary-in-the-Middle (AiTM) attack is a sophisticated phishing technique designed specifically to bypass Multi-Factor Authentication (MFA).

Instead of just trying to steal a password, the attacker's ultimate goal is to steal the session cookie. (A session cookie is the digital "golden ticket" Microsoft gives the browser after successfully logging in with a password and MFA. It's what keeps one logged in so they don't have to authenticate every time they click a new email or open a different app).

The Attack Mechanics

1. The Proxy Setup: The attacker registers a fake domain (like mircosoft-login.com) and sets up a reverse proxy server using an offensive security tool like Evilginx. This server is designed to sit invisibly between the victim and the real Microsoft website.
2. The Lure: The CFO receives a highly targeted phishing email (perhaps disguised as an urgent DocuSign link) and clicks it, landing on the attacker's proxy server.
3. The Relay: The proxy server fetches the real Microsoft login page and displays it to the CFO. When the CFO types their password, the proxy captures it and instantly forwards it to the real Microsoft server.
4. The MFA Challenge: Microsoft verifies the password and triggers an MFA prompt. The proxy relays this screen back to the CFO. Thinking it's a normal login, the CFO taps "Approve" on their phone authenticator app.
5. The Cookie Theft: Microsoft sees a correct password and a successful MFA approval. It generates a valid session cookie and sends it back. This is the critical moment: Because the attacker's server is sitting in the middle of the connection, it intercepts and saves a copy of that session cookie before passing it along to the CFO.
6. The Bypass: The attacker imports that stolen cookie into their own web browser. When they navigate to the CFO's M365 environment, Microsoft sees the valid cookie and assumes the attacker is the CFO who already completed MFA. The attacker now has full access to the account without ever needing to interact with the CFO's phone.