The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →An adversary-in-the-middle (AiTM) phishing attack can let an attacker reuse a session even after you complete multi-factor authentication (MFA). The attacker relays your live sign-in through a fake page, then may steal the authenticated session cookie or token. To spot one, investigate the session and activity that followed it; to prevent repeats, prioritize phishing-resistant sign-in such as FIDO2/WebAuthn security keys or supported passkeys.
How an AiTM phishing attack gets past MFA
An AiTM site acts as a proxy between you and the legitimate service. You enter your password and complete a second factor on the relayed page; the attacker can capture the resulting authenticated session cookie or token and replay it. In other words, MFA may have worked as designed, but the attacker has obtained a session that is already signed in. Microsoft describes this proxy flow in its phishing incident response guidance and identity compromise playbook.
As an Amazon Associate I earn from qualifying purchases.
This does not mean every MFA method is bypassed in the same way. Codes and approval prompts can be relayed or manipulated in some phishing flows. Phishing-resistant methods bind authentication to the legitimate site, making that live relay much harder. CISA identifies phishing-resistant MFA as the strongest MFA category in its 2023 fact sheet; Microsoft’s passkey guidance describes FIDO2 security keys and passkeys.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How to recognize a potentially stolen session
No single unfamiliar sign-in proves an AiTM attack. Compare identity-provider sign-in records with the user’s normal behavior and check what the account did during and after the suspicious session. Verify unusual activity with the user and relevant organizational context; if you cannot confirm it is legitimate, Microsoft’s token-theft guidance says to treat it as a potential breach and mitigate.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Review the sign-in and session
- Look for unfamiliar locations, devices, sign-in properties, and non-interactive sign-ins.
- Investigate anomalous-token alerts and, where relevant to your environment, attempts to access Windows Primary Refresh Tokens.
- Connect the sign-in’s session ID to later cloud activity. A location change associated with the same session can help reveal token reuse.
Microsoft’s token theft playbook lists these signals. Location changes and unusual sign-ins are leads to investigate, not conclusive proof on their own.
Check for account changes and follow-on abuse
- Look for newly registered devices, added MFA or passwordless credentials, and password or credential changes.
- Review unusual or bulk file downloads and increased access to mail or cloud applications.
- Check for new inbox forwarding rules, suspicious mailbox searches, and unexpected mail deletion.
- Review the suspicious URL, email delivery and click records, and related endpoint activity. Search for other messages with the same URL or clicks from different IP addresses.
Correlate identity, email, endpoint, and cloud audit timelines rather than treating each alert in isolation. Microsoft’s phishing response playbook names Microsoft Defender XDR data tables including AadSignInEventsBeta, IdentityLogonEvents, CloudAppEvents, EmailEvents, EmailUrlInfo, UrlClickEvents, and DeviceEvents. Its example queries are specific to Microsoft’s tools and may require relevant access and licensing.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What administrators should do when compromise is suspected
Preserve enough sign-in and audit context to connect the suspicious session to what happened afterward. If activity is confirmed or cannot be validated as legitimate, contain access and remove unauthorized changes.
- Reset the account credentials and revoke or disable its tokens. Follow your identity provider’s account-compromise procedure.
- Remove persistence. Review and remove unauthorized authentication methods, registered devices, mailbox rules, and other access changes identified during investigation.
- Block the infrastructure you found. Use available network protection controls to block malicious URLs and IP addresses; where appropriate, block related sender IP addresses and domains.
- Find related exposure. Search for other recipients and messages carrying the URL, then investigate endpoints and cloud applications used during the compromised session.
- Keep monitoring. Check for new sign-ins and activity after containment. A password reset alone does not establish that other unauthorized access or changes have been removed.
These actions follow Microsoft’s phishing incident response and identity compromise guidance.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to prevent AiTM phishing from stealing usable sessions
Prefer phishing-resistant sign-in
Prioritize FIDO2/WebAuthn security keys or supported passkeys. Configure identity access policies to require the appropriate authentication strength for protected sign-ins; merely offering a stronger option does not ensure that users must use it. CISA urges administrators and high-value targets to implement phishing-resistant MFA or plan a migration. Microsoft states on its Secure Future Initiative progress page: “Traditional MFA is no longer enough—phishing-resistant MFA is the new baseline.”
Microsoft reports that 92% of its employee productivity accounts are protected by phishing-resistant authentication methods; the page does not state a year for that figure. It is Microsoft’s own rollout figure, not an independently verified rate for other organizations.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose a passkey model that fits your control requirements
| Option | Phishing resistance and credential storage | Administrator control and practical considerations |
|---|---|---|
| FIDO2 security key | Phishing-resistant sign-in using a physical key. | Requires compatible services and hardware provisioning, plus enrollment and recovery planning. Platform support and user-support effort vary. |
| Device-bound passkey | Phishing-resistant; bound to a device. | Better suited when policy requires strict device-boundary control. Compatibility, enrollment, recovery, and support still need planning. |
| Synced passkey | Phishing-resistant; a copy can sync across devices. | Microsoft says administrators currently cannot see or control exactly which devices hold a copy. It may not meet strict device-boundary requirements. |
Microsoft’s passkey FAQ explains the distinction between synced and device-bound passkeys. The right choice depends on the services and platforms in use, administrator control needs, and how users will enroll and recover access.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsMake enrollment and recovery part of the security design
Plan how users securely register credentials and regain access if they lose a key or device. Microsoft’s guidance includes time-bound Temporary Access Passes and secure onboarding workflows. Stage deployment across users and applications: hardware provisioning, uneven platform support, changes to user habits, and implementation effort can all affect rollout. Test protected sign-ins and recovery paths before broad enforcement.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Use supporting controls as layers
MITRE ATT&CK’s T1557: Adversary-in-the-Middle (version 2.5, last modified 12 May 2026) lists mitigations that make it harder for an attacker to position between a user and service: restrict unnecessary legacy network protocols, filter traffic, segment network infrastructure, and train people to heed certificate errors. These measures add defense in depth; they do not replace phishing-resistant sign-in.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
