- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
Multi-factor authentication has been the security industry’s most-recommended single control for more than a decade. Indian enterprises have spent real budget rolling out OTP tokens, authenticator apps, and SMS-based 2FA — and those investments were well placed. But attackers have caught up. A class of attack now known as Adversary-in-the-Middle (AiTM) phishing has industrialised the bypassing of every MFA method that relies on a short-lived code. If your organisation thinks “we have MFA, we’re safe,” this article is for you.
Unlike classic credential-harvesting phishing, AiTM attacks insert a reverse-proxy server between the victim and the real identity provider (IdP). When a target user enters their username, password, and OTP on the fake proxy page, the proxy relays those credentials in real time to the legitimate IdP. The IdP returns a valid session cookie. The proxy intercepts that cookie, hands the victim a dummy confirmation page, and the attacker now holds a fully authenticated session — MFA already completed on their behalf.
The result: the attacker’s session is indistinguishable from a legitimate one. No password reset needed. No new-device alert triggered in the first few seconds. Traditional SIEM rules watching for “failed logins” see nothing — the login succeeded.
Several factors make Indian enterprises disproportionately attractive for AiTM campaigns:
Open-source AiTM toolkits (Evilginx, Modlishka, Muraena) are readily available and trivial to customise. A threat actor can stand up a convincing Microsoft 365 or corporate VPN phishing proxy in under an hour on rented cloud infrastructure. The attack chain typically looks like this:
secure-login-[company]-in.com).The critical insight: AiTM does not crack MFA — it completes MFA on behalf of the victim. Defending against it requires controls that make a stolen session token worthless, not just a harder password.
Security teams often ask which MFA method is “safe” against AiTM. The honest answer is that any method producing a time-based or one-time code can be proxied in real time. The proxy simply asks the victim for their code and relays it before it expires. This includes:
What actually resists AiTM: Phishing-resistant MFA — specifically FIDO2/WebAuthn passkeys and hardware security keys (FIDO2 U2F). These bind the authentication cryptographically to the origin domain. A proxy domain cannot satisfy the origin check, so the credential simply does not work on a fake site. This is the technical floor Indian enterprises should be moving toward for privileged and critical-access users.
Transitioning every user to hardware keys overnight is not realistic. Here is a layered approach that reduces AiTM risk incrementally:
Configure your IdP and Zero Trust Network Access (ZTNA) gateway to bind sessions not just to a token but to device posture, IP reputation, and user behaviour baselines. A session cookie stolen from a corporate laptop should fail when replayed from a threat actor’s VPS with a different device fingerprint. PJ Networks’ ZTNA deployments (on FortiGate and Fortinet ZTNA agents) implement device-identity certificates that make session replay from an unmanaged device immediately detectable.
If your organisation is on Microsoft Authenticator or a similar push-based system, enable number matching and additional context (login location, application name). While not bulletproof against a sophisticated proxying toolkit, these controls significantly reduce the success rate of mass AiTM campaigns, which rely on confused or inattentive users approving push notifications automatically.
Even a successful AiTM login leaves forensic traces: the session’s IP geolocation changes between the victim’s legitimate activity and the attacker’s use. Alerts on impossible travel (same account, two continents, ten minutes apart), atypical login times, and sudden bulk-access to file repositories should trigger immediate session revocation — not just a human-reviewed ticket.
Apply least-privilege to every cloud identity. An AiTM compromise of a finance analyst’s Microsoft 365 account should not provide access to production databases or the IT admin portal. Role-based access controls, conditional-access policies tied to user risk scores, and micro-segmentation of on-premises resources all limit how far a stolen session can travel.
AiTM proxy domains often share visual characteristics: slightly different domain names, missing or mismatched TLS Subject Alternative Names, unusual redirects. Regular phishing simulation exercises that specifically test AiTM-style lures (as distinct from generic credential-harvesting tests) build muscle memory in high-risk user populations such as finance, HR, and executives.
Even if full FIDO2 rollout is years away, protecting your Domain Admins, Azure Global Admins, and financial approvers with hardware FIDO2 keys is achievable within a quarter. Privileged accounts are the primary post-compromise objective; hardening them first delivers the highest risk reduction per rupee spent.
Detecting and containing AiTM attacks requires more than a SIEM alert — it requires a platform that correlates identity events, network telemetry, and automated response into a single operational picture. PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner, operating the platform for clients across manufacturing, BFSI, healthcare, and critical infrastructure in India.
SIEM — Correlation Across Identity and Network Events: PrahiX Ora’s SIEM ingests logs from Microsoft Entra ID, on-premises Active Directory, FortiGate firewalls, endpoint agents, and cloud platforms into a single correlation engine. Detection rules mapped to MITRE ATT&CK Technique T1557 (Adversary-in-the-Middle) and T1539 (Steal Web Session Cookie) fire when a session is used from an IP that did not originate the authentication. The platform’s graph-based attack storyline reconstruction links the stolen session event back to the phishing delivery vector — a capability that matters directly for CERT-In’s 180-day in-country log retention direction, which requires organisations to be able to reconstruct incident timelines well after the fact.
NMS — Network-Level Visibility Across the Enterprise: AiTM traffic often traverses corporate networks on its way from end-user devices to cloud identity providers. PrahiX Ora’s Network Management System provides unified observability across FortiGate NGFWs, managed switches, Wi-Fi access points, and SD-WAN edges with LLDP/CDP topology discovery and ML-based traffic anomaly detection. In multi-vendor estates where NOC visibility is otherwise fragmented — a common challenge in mid-size Indian enterprises that have grown through acquisition — the platform’s single-pane-of-glass view ensures no lateral-movement path goes unmonitored.
Video Surveillance (VMS) — Physical and Network Security Together: For organisations operating manufacturing plants, retail branches, or multi-site campuses, PrahiX Ora’s video surveillance (VMS) module integrates ONVIF-compatible cameras (including Hikvision and Dahua) with network security alerts. An AiTM-facilitated account compromise that is followed by unusual physical-badge activity at a data-centre door can be correlated in a single operations view — closing the gap between physical and cyber security that most standalone SIEM tools leave open.
SOAR — Automating the Six-Hour CERT-In Window: CERT-In’s 2022 directive requires organisations to report cybersecurity incidents — including account compromises — within six hours of detection. Manual investigation and escalation processes routinely miss this window. PrahiX Ora’s SOAR module includes pre-built playbooks for identity-compromise scenarios: automatic session revocation commands pushed to Azure AD and on-premises AD, blocklist entries pushed directly to FortiGate via API, and a pre-populated CERT-In notification draft populated from the platform’s incident timeline. Automation is what makes a six-hour reporting window realistic at scale.
For organisations looking to assess their current exposure to AiTM attacks and their detection and response capability, PJ Networks offers a Managed SecOps engagement that deploys PrahiX Ora and provides 24/7 NOC/SOC coverage from day one.
An AiTM-enabled account takeover that accesses personal data — employee records, customer information, financial data — immediately triggers obligations under both CERT-In’s 2022 Directions and the DPDP Act, 2023. The six-hour CERT-In reporting clock starts from the moment of detection, not from the moment of breach. Organisations that discover an AiTM compromise through a log review three days after the event face the question: when did detection occur, and can we evidence our detection timeline?
Strong SIEM coverage with tamper-evident log retention (supporting CERT-In’s 180-day direction) and automated incident playbooks are not just operational best practices — they are increasingly the difference between a regulatorily defensible incident response and an enforcement action. PrahiX Ora’s log retention architecture (tiered hot/cold/archive storage with chain-of-custody metadata) helps evidence that your organisation’s detection and retention obligations were met — note that no technology platform can make your organisation DPDP-compliant on its own, but the right tooling supports your compliance programme materially.
AiTM is not a theoretical threat — multiple Indian BFSI and IT/ITeS organisations have experienced account takeovers via this vector in the past 18 months. Here is a prioritised action list for CISOs and IT heads:
Adversary-in-the-Middle attacks represent a genuine evolution in the threat landscape, not a marginal refinement. They do not break MFA — they sidestep it entirely by operating at the session layer. The enterprises that respond well will be those that move from a “MFA as the last gate” mindset to a continuous verification posture: every session, every device, every access request evaluated against risk signals in real time.
PJ Networks helps Indian enterprises build exactly that posture — through FortiGate NGFW deployments, ZTNA rollouts, FortiMail-based phishing prevention, and 24/7 NOC/SOC operations powered by PrahiX Ora. If your organisation is re-evaluating its identity and access security architecture in light of AiTM threats, we welcome the conversation.
Contact PJ Networks to discuss a Managed SecOps assessment or a PrahiX Ora pilot for your environment.