It’s widely recognised that multi-factor authentication (MFA) is essential for defending your organisation’s Microsoft 365 and Microsoft Entra environments against threats.

But MFA has become less effective in recent years, owing to advanced attack methods like “Adversary-in-the-Middle” (AiTM) that can compromise even MFA-protected accounts.

All this makes traditional MFA methods no longer as secure as they once were.

In this blog, we’ll unpack the problems of AiTM and explain how solutions like phishing-resistant MFA can overcome these threats.

What is an Adversary-in-the-Middle (AiTM) attack?

Adversary-in-the-Middle (AiTM), or man-in-the-middle, is an advanced phishing technique where an attacker secretly intercepts and manipulates communication between a user and a service (e.g. Microsoft 365) without either the user or provider realising it. Attackers are now able to intercept authentication tokens in real time, bypassing MFA and gaining unauthorised access to user accounts.

Worryingly, the tools being used to carry these attacks out, like Evilginx2, Modlishka, and Muraena, are publicly available and can be up and running in minutes.

How does an Adversary-in-the-Middle (AiTM) attack work?

1. Malicious link generated – The attacker will generate a malicious link that will direct the target user to a fake login page that looks identical to the Microsoft 365 login page.

2. Phishing email sent – The attacker sends an email to the target user with the malicious link. This email will often include a convincing message about an urgent request that requires the target user to click the malicious link.

3. Malicious link accessed – The target user opens the link to the fake login page and enters their username and password whilst also fulfilling the requirement for MFA. The target user does this without realising they have signed into a fake login page.

4. Session hijacked – The attacker intercepts the session token (authentication cookie) as well as the user’s username and password. The attacker can then use the session token to log in as the target user with MFA already approved.

5. Persistent access – The attacker, now with access to the environment, can steal data, perform harmful actions, or register their own MFA authentication methods in order to log in as the user again once the token expires.

Why do traditional MFA methods fail against Adversary-in-the-Middle attacks?

Traditional MFA methods fail against Adversary-in-the-Middle attacks because they are not bound to specific hardware or subject to proximity requirements. This means that if a user is tricked into submitting a traditional MFA request, the token associated with that request can be intercepted and used by the attacker to gain access to an organisation’s Microsoft 365 environment from any device.

How to protect your organisation from Adversary-in-the-Middle attacks

1. Implement phishing-resistant MFA

The most effective method to prevent AiTM attacks is to use phishing-resistant multi-factor authentication options. If implemented with an option that requires a cryptographic relationship between the user’s device and the service, phishing-resistant MFA can prevent most AiTM attacks with close to a 100% success rate.

Below are examples of the phishing-resistant MFA options available in Microsoft 365:

• Passkeys (FIDO2 Security Keys) (e.g. Microsoft Authenticator, YubiKey)
  • Using passkeys or FIDO2 Security Keys for authentication requires the user to use a digital or physical key to authenticate. This removes the risk of AiTM attacks as the attacker must also have the key in order to successfully authenticate.
  • In the past, the use of FIDO2 Security Keys has been awkward due to the user needing to carry around a physical key, but users can now use a digital key instead, which can be configured for Microsoft 365 users using the Microsoft Authenticator app on an existing mobile device.

• Windows Hello for Business / Platform Credential (macOS)
  • Windows Hello for Business and Platform Credential for macOS work similarly to passkeys, but instead of requiring the digital key to be stored on a separate device, the key is tied to the same hardware used by the user for day-to-day access to Microsoft 365.
  • This option can also be paired with a local device PIN or biometric (face or fingerprint) to provide extra protection while remaining passwordless.

• Certificate-Based Authentication
  • Certificate-based authentication lets users authenticate to Microsoft 365 using a trusted certificate that authenticates against the organisation’s Public Key Infrastructure. Like the methods above, this method is also passwordless.
  • If an attacker were to attempt an AiTM attack against a user using certificate-based authentication, the attack would be unsuccessful unless they were somehow able to export the required certificate and authenticate against the organisation’s Public Key Infrastructure.

2. Require compliant devices for access

Another effective method to strengthen overall security and combat AiTM attacks is to check your devices for compliance and enforce Conditional Access policies to block access from noncompliant devices.

3. Enable number matching and additional context for Microsoft Authenticator

If you’re not quite ready to roll out phishing-resistant MFA, you can still strengthen your existing MFA posture by doing the following:

• Requiring the Microsoft Authenticator
  • The Microsoft Authenticator app is more secure than other authentication methods available. You can disable the use of weaker methods and require users to register and use the Microsoft Authenticator app.

• Enabling number matching in the Microsoft Authenticator app
  • MFA fatigue is another common type of attack used to trick users into approving repeated MFA requests. Enabling number matching in the Microsoft Authenticator app can help to reduce the success of MFA fatigue attacks by requiring users to match the code displayed on the screen when an attacker attempts to log in.

• Enabling additional context in the Microsoft Authenticator app
  • Another option is to enable extra information in the Microsoft Authenticator app, which again helps to prevent MFA fatigue attacks by giving users helpful data such as the app or location that the authentication attempt is being initiated from. This allows the user to make better judgements on whether authentication notifications are genuine or not.

4. Enforce risk-based access controls

Conditional Access policies can be used to enforce risk-based access control by evaluating the risk associated with a user’s sign-in or account activity. If a risky sign-in or compromised account is detected, additional security measures can be enforced, such as requiring MFA, a password reset, or blocking access.

Examples of risky activities include:

• Unusual or malicious IP addresses
• Unlikely or impossible travel
• Multiple failed sign-in attempts
• New device registrations
• Leaked credentials

5. User education

Lastly, end-user awareness is critical. Training your people to recognise phishing attempts or malicious activity can help to prevent them from falling victim to phishing and other types of attacks. Key things to make your people aware of are:

• How to identify malicious URLs and emails
• How to recognise phishing and social engineering
• The importance of strong authentication

Need any help to get started?

If you need assistance to help protect your organisation from day-to-day threats or simply want to improve your overall cyber security posture, then please get in contact with us today to see how we can support you.

Receive more blogs like this straight into your inbox

Sign up to receive our latest blogs and stay up to date with our latest news, Microsoft 365 updates, events, webinars and workshops.

Get Industry Insights

Subscribe to stay up to date with Microsoft 365 news and technology