Adversary-in-the-Middle (AiTM) attacks use a reverse-proxy phishing page that sits between the victim and the real login portal. As the victim authenticates, the proxy captures their password and the resulting session cookie, allowing the attacker to bypass multi-factor authentication entirely.
AiTM and infostealers attack the same prize from different angles: the live session token. Where AiTM phishes it in real time, infostealers harvest it from the browser after infection. Both render password-only defenses insufficient.
Read about a popular phishing proxy in our Evilginx analysis and session-token theft via malware in the Google OAuth session hijacking report.