Adversary-in-the-middle attacks have moved session token theft from a theoretical concern to the dominant credential attack vector in 2026. The defensive response has improved. The adoption of the improved defences across organisations is uneven enough that the attack vector remains highly productive for the criminal economy.

What AiTM attacks actually do

The attacker stands up an infrastructure that proxies the legitimate authentication flow. The victim sees what looks like the legitimate login page. They authenticate, including with multi-factor methods. The authentication completes successfully. The session token issued at the end of the authentication is captured by the attacker before being passed to the victim.

The attacker then uses the captured session token to access the victim’s account from their own systems. The MFA challenge has already been satisfied. The session token is valid. The application sees a legitimate session.

The attack defeats traditional MFA. It does not defeat phishing-resistant authentication, but most organisations have not deployed phishing-resistant authentication at scale.

The detection challenge

Detecting session token reuse is harder than detecting password reuse. The session token is the same as the legitimate session token. Both sessions look the same to the application unless additional context is examined.

The context that can be examined includes the source IP address, the device fingerprint, the user agent, the geolocation, the time pattern of access, and the behavioural pattern of the session activity. Each of these provides a partial signal. Combining them well is the detection work.

What is working

Continuous authentication systems that evaluate session legitimacy on an ongoing basis are the most effective detection layer in 2026. These systems compute a confidence score for the session based on the combined context signals. If the confidence drops below a threshold, the session is challenged or terminated.

The implementations that work well combine machine learning over the user’s historical behaviour with deterministic rules for high-risk signals. Pure ML implementations produce false positives at rates that disrupt user experience. Pure rule-based implementations miss novel attack patterns.

The biggest deployment success has been with the identity providers that build continuous authentication directly into the platform. Microsoft, Google, and Okta all offer mature continuous authentication features. The customers who have enabled the features and tuned them to their environment are seeing meaningful reductions in successful AiTM attacks.

What is not working

Adoption is the largest single gap. The continuous authentication features that work are available to most large organisations. The percentage of organisations that have enabled them and tuned them properly is substantially below 50%, and the percentage of mid-market organisations with effective continuous authentication is much lower.

The other gap is application-level integration. Continuous authentication works best when the application is integrated with the identity provider’s risk signals. Many applications run their own session management without consulting the identity provider, which produces blind spots that AiTM attacks exploit.

The phishing-resistant authentication endgame

The structural solution to AiTM is phishing-resistant authentication. FIDO2 security keys, platform authenticators, and passkeys are immune to AiTM because the cryptographic exchange is bound to the legitimate origin and cannot be proxied successfully.

Adoption of phishing-resistant authentication continues to lag the adoption of less effective MFA methods. The reasons include device compatibility, user experience friction, and lack of executive sponsorship for the rollout effort.

The organisations that have made the transition are not seeing AiTM attacks succeed against their authenticated users. The economic incentive to make the transition is real and growing. The question is whether the transition happens before or after a major breach event drives broader urgency.

What to do

Organisations not yet on the journey should start. Enable the continuous authentication features in the identity provider. Roll out phishing-resistant authentication to high-risk users first. Tighten session lifetimes for sensitive applications. Audit application-level session management for gaps with the identity provider’s risk signals.

None of this is novel. The work is the work. The question is whether it gets done.