The picture most people have of a man-in-the-middle attack is a stranger on the cafe Wi-Fi reading your email out of the air. That version was real and it mostly stopped working, because almost every site you use now encrypts what it sends. The idea underneath did not stop working: get between two parties who each believe they are talking directly, and you can read everything and change anything. The attack moved rather than died, and the defenses that used to matter are not the ones that matter.
What Is a Man-in-the-Middle Attack?
NIST's glossary keeps it to one sentence. It is an attack in which an attacker is positioned "between two communicating parties in order to intercept and/or alter data traveling between them."
Two words there do the work. Positioned means the traffic genuinely flows through the attacker rather than past them, which separates this from ordinary eavesdropping. Alter is the half people forget: an attacker in the middle can change an invoice's bank details, swap a download for a different file, or inject a script into a page you trust, without either end noticing.
One condition is unstated but decisive: both parties have to believe the connection is direct. Everything the attacker does is aimed at preserving that belief, and every defense that works is aimed at breaking it. That is why a certificate warning matters more than any other signal, and why this is the one of the cyber security threats where the browser, not the antivirus, does the defending.
How Does a Man-in-the-Middle Attack Work?
The classic attack has two stages, and every explanation of it uses the same two words: interception, then decryption.
Interception puts the attacker on the path: on a local network, by answering ARP requests with their own hardware address or DNS queries with their own server, and on public Wi-Fi by simply being the network, running a hotspot named after a real one.
Decryption is the hard part, and where the attack now usually fails. Getting the traffic is not the same as reading it, because encryption between your browser and the site is negotiated end to end. Attackers respond by trying to stop it starting, called SSL stripping, or by presenting a certificate they hope the browser accepts.
- The attacker gets on the pathThe same public network, a compromised office switch, or a hotspot they set up
- Routing is poisonedARP or DNS replies claim the attacker is the gateway or the server you asked for
- Traffic reroutesYour device sends everything to them first, believing they are the router
- Encryption is attackedA downgrade to plain HTTP, or a certificate the browser is asked to accept
- The browser refusesCertificate checks and HTTPS-only rules break the connection instead of downgrading it
- What is left is thinWhich sites you visited, and anything an app still sends unencrypted
Types of Man-in-the-Middle Attacks
The names describe where the attacker sits rather than different attacks. Read the table as a vocabulary.
| Type | Where the attacker sits | What it gets | The tell |
|---|---|---|---|
| ARP cache poisoning | On your local network, claiming to be the router | Everything the device sends and receives | Sudden slowdowns, repeated disconnections |
| DNS spoofing | Between you and name resolution | You, delivered to a look-alike site | An address that is slightly wrong, or a certificate that is |
| DHCP spoofing | Handing out network settings first | Your gateway and DNS server, both theirs | Settings that do not match the ones you expect |
| Evil twin Wi-Fi | Running a hotspot named after a real one | Everything sent over that network | A familiar network asking you to sign in again |
| SSL stripping | Between you and the start of encryption | Whatever you send before HTTPS begins | http rather than https, and no lock in the address bar |
| Rogue certificate | Holding a certificate the browser trusts | Encrypted traffic, decrypted in the middle | Usually nothing, which is why certificate transparency exists |
| Session hijacking | Holding a stolen session cookie | Your logged-in account, with no password needed | Being logged out, or an unfamiliar active session |
| Email hijacking | Inside a mailbox on the route | Invoices and payment details, altered in flight | Bank details that changed on the newest reply in a real thread |
| Replay | Recording valid traffic and sending it again | A repeated login or transaction | Duplicate charges or confirmations |
The first four are interception techniques, the next two are decryption techniques, and the last three are what an attacker does once either has worked. Security teams treat this as a position rather than an event for that reason.
What Is the Most Common Man-in-the-Middle Attack?
Today it is none of the network techniques above. It is a phishing page that works as a proxy, and CISA describes the mechanic exactly in its fact sheet on implementing phishing-resistant MFA: a threat actor sends an email convincing the user to visit a site mimicking a company's legitimate login portal, and "the user submits their username, password, as well as the 6-digit code from their mobile phone's authenticator app."
The page is not a copy. It is a live relay holding one connection to you and another to the real service, passing everything through both ways.
Every connection in that diagram is legitimate and carries a valid certificate. Nothing is stripped, poisoned or downgraded. The only thing that went wrong is that you started at the wrong address, which makes this a phishing page problem in a man-in-the-middle costume.
What Is MITM Called Now?
The term is being retired in a lot of documentation, and you will meet at least four replacements: on-path attack, machine-in-the-middle, manipulator-in-the-middle, and adversary-in-the-middle, usually abbreviated AiTM.
The one worth knowing is the last, because it is the one you will see in an alert. MITRE ATT&CK catalogs the technique as Adversary-in-the-Middle, T1557, described as adversaries positioning "themselves between two or more networked devices" to support follow-on behavior such as network sniffing, data manipulation or replay attacks. Its four sub-techniques are name resolution poisoning and SMB relay, ARP cache poisoning, DHCP spoofing, and evil twin. If a security tool names one of those, it is telling you which row of the table above it thinks it found.
What Are the Signs of a Man-in-the-Middle Attack?
Most are weak. One is strong.
The weaker signs prove nothing alone: no lock in the address bar, http where https belongs, a network slowing or dropping repeatedly, a familiar Wi-Fi network asking you to sign in again, a redirect you did not click.
The account-side signs matter more, because they appear after a successful relay: an unexpected sign-in alert, a session you do not recognize, a mailbox rule you did not create, or being logged out of everything at once.
How Often Do Man-in-the-Middle Attacks Happen?
Nobody publishes a count, because this is a technique rather than a crime category and victims report the outcome rather than the method. What can be measured is the shape of the attacks that use it. The FBI's 2025 Internet Crime Report records 191,561 phishing and spoofing complaints, more than any other crime type, and 24,768 business email compromise complaints carrying $3,046,598,558 in losses. Business email compromise is the costliest man-in-the-middle outcome, because it depends on someone reading a real invoice thread and changing the bank details on it.
The bypass is routine rather than exotic. CISA and the FBI describe the group behind several of this year's large intrusions as experts in social engineering who use phishing, push bombing and SIM swap attacks to obtain credentials and get past MFA.
The network version, meanwhile, has become rare against consumer traffic and stayed common inside corporate networks, where ARP and DNS poisoning are standard steps in an internal intrusion. The recent data breaches on this site show the pattern that replaced it: the way in is a person, and the thing taken is a session.
How to Prevent Man-in-the-Middle Attacks
Note what is missing from the top of the list. A VPN protects the network segment, and the modern attack does not touch the network segment.
For an organization the list continues inward: segment the network, turn off legacy name resolution protocols, watch for ARP anomalies, and move admin accounts to hardware keys first. Ordinary multi-factor authentication still stops the great majority of attacks and everyone should have it. It is the relay specifically that it does not stop.
Is Public Wi-Fi Safe?
Safer than its reputation, and the FTC says so directly: because of the widespread use of encryption, "connecting through a public Wi-Fi network is usually safe." Information used to be at risk on these networks, the agency notes, and most websites now encrypt it, which is the change that closed the classic attack.
This is contested advice, and much of the guidance to avoid public Wi-Fi comes from companies selling VPNs. Our view is the FTC's: check for the lock and the https, keep your software updated, and use the network.
Key takeaways
- A man-in-the-middle attack puts an attacker between two parties who think they are talking directly, able to read and to alter what passes.
- The classic network version, ARP and DNS poisoning and evil twin Wi-Fi, largely stopped working against consumers because nearly everything is encrypted now. The common version today is an adversary-in-the-middle phishing page: a live relay that forwards your password and one-time code and keeps the session cookie.
- A stolen session cookie survives a password change, so sign out of all sessions rather than only resetting the password. Passkeys and security keys are the control that stops the relay, because the authenticator checks the address itself. A VPN does not.
- The certificate warning is the one local sign worth trusting, and public Wi-Fi is safer than its reputation.
Common questions
What is a man-in-the-middle attack in simple terms?
Someone positions themselves between you and the website or person you are talking to, so everything you send passes through them first. They can read it and change it, while both ends believe the connection is direct.
What is the most common man-in-the-middle attack?
An adversary-in-the-middle phishing page. It looks like a normal login screen but relays everything you type to the real site, including your one-time code, then keeps the session cookie. Network attacks like ARP poisoning are now mostly seen inside corporate networks.
What is MITM called now?
On-path attack, machine-in-the-middle, manipulator-in-the-middle and adversary-in-the-middle are all in use. AiTM is the one to know, because MITRE ATT&CK catalogs the technique under that name as T1557.
What are the signs of a man-in-the-middle attack?
A certificate warning is the strong one, along with a missing lock on a site that should have it. Weaker signs include a network slowing or dropping, a familiar Wi-Fi network asking you to sign in again, and unexpected redirects. Afterward, watch for sign-in alerts and unfamiliar sessions.
How often do man-in-the-middle attacks happen?
No agency counts them, because it is a technique rather than a crime category. The measurable proxy is phishing, which drew 191,561 complaints to the FBI in 2025, and business email compromise, which cost $3.05 billion, much of it through altered invoice threads.
Does a VPN stop man-in-the-middle attacks?
It stops the version where someone is snooping your local network, which is now the rare one. It does nothing against a phishing page that relays your login, because that connection is properly encrypted to the wrong destination.
Does HTTPS stop man-in-the-middle attacks?
It stops the reading and altering, which is most of it. HTTPS authenticates the site as well as encrypting the traffic, so an attacker in the middle cannot decrypt without a certificate your browser accepts. It cannot tell you that you started at the wrong address.
Can a man-in-the-middle attack bypass two-factor authentication?
Codes can be relayed: a proxy page asks for your six-digit code and forwards it within seconds, and push prompts get approved by mistake. Passkeys and hardware security keys cannot be relayed, because the authenticator verifies the site's address before responding.
How do I stop a man-in-the-middle attack once it has happened?
Sign out of all sessions everywhere, since the stolen item is usually a session cookie that a password change does not touch. Then change the password, check for mail forwarding rules and unfamiliar devices, and turn on a passkey so the same relay cannot work twice.
On this page
- What Is a Man-in-the-Middle Attack?
- How Does a Man-in-the-Middle Attack Work?
- Types of Man-in-the-Middle Attacks
- What Is the Most Common Man-in-the-Middle Attack?
- What Is MITM Called Now?
- What Are the Signs of a Man-in-the-Middle Attack?
- How Often Do Man-in-the-Middle Attacks Happen?
- How to Prevent Man-in-the-Middle Attacks
- Is Public Wi-Fi Safe?
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.