In January 2024, the FBI's Internet Crime Complaint Center flagged business email compromise — much of it powered by man in the middle attack techniques — as responsible for over $2.9 billion in adjusted losses during 2023 alone. That number isn't slowing down. I've investigated incidents where a single intercepted email thread between a CFO and a vendor resulted in a six-figure wire transfer landing in a threat actor's offshore account. The attacker didn't hack a firewall. They simply sat between two people who trusted each other.

If you're responsible for securing your organization's communications, this post breaks down exactly how these attacks work, what they look like in the wild, and what actually stops them.

What Is a Man in the Middle Attack?

A man in the middle attack (MITM) occurs when a threat actor secretly intercepts and potentially alters communication between two parties who believe they're talking directly to each other. Think of it as a digital eavesdropper who can read, modify, and inject messages in real time.

The attacker positions themselves between your device and the server you're connecting to — whether that's your bank, your email provider, or your company's VPN. Neither side knows the attacker is there. That's what makes it so dangerous.

MITM attacks aren't theoretical. They're a core technique behind credential theft, session hijacking, and data breach incidents across every industry.

How a MITM Attack Actually Works: Step by Step

1. Interception: Getting in the Middle

The attacker first needs to position themselves between you and your destination. Common methods include:

  • ARP Spoofing: The attacker sends forged ARP messages on a local network, linking their MAC address to the IP address of a legitimate gateway. All traffic meant for that gateway now flows through them.
  • DNS Spoofing: The attacker corrupts DNS cache entries so that domain lookups resolve to their malicious server instead of the real one.
  • Rogue Wi-Fi Access Points: Setting up a fake hotspot named "Airport_Free_WiFi" or "Starbucks_Guest" at a public location. Every device that connects routes traffic through the attacker.
  • SSL Stripping: The attacker downgrades an HTTPS connection to HTTP, removing encryption without the user noticing the padlock disappearing from their browser.

2. Decryption and Data Harvesting

Once positioned, the attacker can read login credentials, session tokens, financial data, and personal information in plaintext. In more sophisticated operations, they use tools to decrypt TLS traffic by presenting forged certificates to the victim's browser.

3. Relay or Manipulation

The attacker can either passively monitor or actively alter the communication. I've seen cases where attackers changed invoice payment details mid-email, redirecting hundreds of thousands of dollars. The sender's email looked legitimate. The recipient's reply went to the right person. Only the bank account number was different.

Real-World MITM Attacks You Should Know About

In 2015, European law enforcement agency Europol arrested 49 suspects across Europe as part of a crackdown on man in the middle attacks targeting businesses. The attackers monitored corporate email communications, identified pending payments, and then impersonated suppliers to redirect funds. The operation uncovered over €6 million in losses.

More recently, the Verizon 2024 Data Breach Investigations Report highlighted that the "use of stolen credentials" was involved in roughly 31% of all breaches over the past decade — and MITM attacks remain one of the primary methods for harvesting those credentials in the first place. You can review the full findings at Verizon's DBIR page.

These aren't nation-state attacks. Many are carried out by moderately skilled criminals using open-source tools available on GitHub. The barrier to entry is disturbingly low.

The Coffee Shop Problem: Why Public Wi-Fi Is Still a Minefield

I still see executives checking corporate email on hotel and airport Wi-Fi without a VPN. Every time, I wince.

A rogue access point attack takes about five minutes to set up with a $35 device and some widely available software. The attacker creates a hotspot that looks identical to the venue's real network. Your device connects automatically if it has connected to a similarly named network before. From that moment, every unencrypted packet you send is readable.

This is social engineering at the infrastructure level — exploiting trust rather than breaking encryption.

Five Defenses That Actually Stop MITM Attacks

1. Enforce HTTPS Everywhere

HSTS (HTTP Strict Transport Security) headers tell browsers to only connect via HTTPS, defeating SSL stripping attacks. CISA recommends HSTS adoption across all federal web properties, and your organization should follow the same standard. See CISA's HTTPS guidance for implementation details.

2. Deploy Multi-Factor Authentication (MFA)

Even if an attacker captures your password through a MITM attack, multi-factor authentication adds a second barrier. Hardware-based tokens like FIDO2 keys are the strongest option because they're resistant to phishing and real-time credential relay attacks.

SMS-based MFA is better than nothing, but it's vulnerable to SIM swapping. Push-based or hardware MFA is what I recommend to every client.

3. Adopt a Zero Trust Architecture

Zero trust assumes that no user, device, or connection is trustworthy by default — even inside your network. This model verifies every request, segments access, and limits lateral movement. NIST Special Publication 800-207 provides the authoritative framework for implementing zero trust, available at NIST's SP 800-207 page.

If an attacker does manage a MITM position, zero trust principles limit what they can access or do with intercepted sessions.

4. Use a VPN on Untrusted Networks

A properly configured VPN encrypts all traffic between your device and your organization's network, rendering interception useless to the attacker. The key phrase is "properly configured" — split-tunnel VPNs that only route some traffic through the tunnel still leave gaps.

5. Train Your People to Recognize the Signs

Technical controls fail when employees ignore certificate warnings, connect to suspicious networks, or fall for phishing simulations that lead to credential theft pages. Security awareness training is the layer that makes every other defense stronger.

Our cybersecurity awareness training program covers MITM scenarios, social engineering tactics, and real-world credential theft techniques so your team can recognize threats before they click.

Can Your Organization Detect a MITM Attack in Progress?

Detection is harder than prevention, but not impossible. Watch for these indicators:

  • Unexpected certificate warnings — browsers flagging mismatched or self-signed certificates mid-session.
  • Unusual DNS resolution — internal DNS queries returning unexpected IP addresses.
  • ARP anomalies — multiple IP addresses resolving to the same MAC address on your LAN.
  • Authentication anomalies — user accounts logging in from geographically impossible locations within short time windows.

Network monitoring tools like IDS/IPS systems can catch ARP spoofing and DNS anomalies if properly tuned. But the first line of detection is often a trained employee who notices something feels wrong — a certificate warning, a strange redirect, an email that doesn't quite match the sender's usual tone.

Why Phishing and MITM Attacks Go Hand in Hand

Here's what many organizations miss: phishing is frequently the delivery mechanism for a man in the middle attack. An employee clicks a link in a convincing email, lands on an attacker-controlled proxy site that looks identical to the real login page, and enters their credentials. The proxy relays those credentials to the real site in real time, captures the session token, and the attacker now has authenticated access.

This technique — called real-time phishing or adversary-in-the-middle — defeats basic MFA implementations. It's the reason phishing simulation and training programs need to stay current with evolving tactics.

Our phishing awareness training for organizations specifically addresses these adversary-in-the-middle scenarios, teaching employees to verify URLs, inspect certificates, and report suspicious login prompts before entering credentials.

The Ransomware Connection

MITM attacks aren't always the endgame — they're often just the entry point. Once an attacker captures valid credentials through interception, they can move laterally through your network, escalate privileges, and deploy ransomware. I've seen this pattern repeatedly: intercepted VPN credentials become domain admin access within 48 hours, followed by a full ransomware deployment that encrypts every connected system.

Stopping the MITM attack early breaks this entire kill chain.

Your Next Steps

A man in the middle attack succeeds because it exploits trust — trust in networks, certificates, and the assumption that nobody is listening. The fix is layered: enforce encryption, verify identities with strong MFA, adopt zero trust, monitor for anomalies, and train every person in your organization to question what seems normal.

Start with what you can control today. Roll out HSTS headers on your web properties. Require hardware MFA for privileged accounts. And give your team the training they need to recognize social engineering before it escalates into a data breach.

The attackers are already in the middle. The question is whether your defenses are ready to push them out.