{"id":7767,"date":"2025-03-27T10:41:37","date_gmt":"2025-03-27T15:41:37","guid":{"rendered":"https:\/\/lg-staging.lougcloud.com\/?p=7767"},"modified":"2025-07-24T11:57:05","modified_gmt":"2025-07-24T16:57:05","slug":"adversary-in-the-middle-phishing-attack","status":"publish","type":"post","link":"https:\/\/lg-staging.lougcloud.com\/?p=7767","title":{"rendered":"Adversary in the Middle Phishing: How to Protect Your Business"},"content":{"rendered":"\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-85bp3-f856194ef33e7bc72ec0d3bf98278fce\">\n.flex_column.av-85bp3-f856194ef33e7bc72ec0d3bf98278fce{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-85bp3-f856194ef33e7bc72ec0d3bf98278fce av_one_full  avia-builder-el-0  el_before_av_section  avia-builder-el-no-sibling  first flex_column_div av-zero-column-padding  '     ><p><br \/>\n<section  class='av_textblock_section av-k0pon615-92ea21455f84089b14b66129c69212c2 '  ><div class='avia_textblock' ><h1>Adversary in the Middle Phishing: How to Protect Your Business<\/h1>\n<\/div><\/section><br \/>\n<section  class='av_textblock_section av-k0pop9td-bbcbe599b29853166e54fa81e9bef78a '  ><div class='avia_textblock' ><p>Cybercriminals are constantly evolving their tactics, and one of the latest phishing techniques combines 2 methods to be particularly effective. After an account is compromised instead of using email to send a phishing message, attackers have begun uploading a file to OneDrive or Sharepoint and then using those services to send document sharing requests. They are embedding a link in the document that when clicked will redirect to what looks like a Microsoft Login page. These methods allow them to successfully deliver their Phishing email via a compromised account and allow them to capture the MFA token. Once they have the MFA token, they can bypass MFA protections and compromise your account.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-7768\" src=\"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack.jpg\" alt=\"Illustration of an adversary in the middle phishing attack using a fake login page to steal session tokens.\" width=\"1200\" height=\"1040\" srcset=\"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack.jpg 1200w, https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack-300x260.jpg 300w, https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack-1030x893.jpg 1030w, https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack-768x666.jpg 768w, https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack-705x611.jpg 705w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><\/p>\n<h2>Understanding Adversary in the Middle Phishing Attacks<\/h2>\n<ol>\n<li>Compromised Employee Accounts \u2013 An attacker gains access to an employee\u2019s email account, often through previous phishing attempts or credential theft.<\/li>\n<li>Deceptive Internal Distribution \u2013 The attacker then uses that account to access File Share or Collaboration applications and sends document sharing requests. Since the email originates from a legitimate application, it easily bypasses traditional email security filters.<\/li>\n<li>Fake Login Pages &#038; Session Hijacking \u2013 The email contains a legitimate-looking link to a shared document, which leads to a fake Microsoft login page. This page may even accept MFA pushes or number matching, creating a false sense of security. However, it does not actually log in to anything.<\/li>\n<li>Error Message &#038; Account Compromise \u2013 Once credentials are entered, the attacker intercepts the session token using a reverse proxy. By the time the user sees a login error message, their account has already been compromised.<\/li>\n<\/ol>\n<h3>Key Warning Signs of This Attack<\/h3>\n<ul>\n<li>A user reports that they are logging in but receiving a login error message.<\/li>\n<li>Unexpected, shared document notifications.<\/li>\n<li>PDF attachments containing clickable images that direct users to external login pages.<\/li>\n<\/ul>\n<h3>Why Traditional Email Security Measures Fail<\/h3>\n<p>Most <a href=\"https:\/\/lg-staging.lougcloud.com\/news\/email-security-protecting-your-business-from-common-cyber-threats\/\">email security systems<\/a> are designed to detect external threats, suspicious attachments, or known phishing indicators. However, since these phishing emails originate from a collaboration or file share service \u2014 security filters won\u2019t flag them as malicious. That makes this attack extremely effective and difficult to detect with email scanning technology.<\/p>\n<h2>Best Practices for Protecting Your Organization<\/h2>\n<ol>\n<li><a href=\"https:\/\/lg-staging.lougcloud.com\/news\/cyber-security-awareness-training\/\">Enhance Cybersecurity Awareness Training<\/a> \u2013 Educating employees on the latest phishing tactics is the best defense. Teach staff to be cautious of unexpected shared document emails, even from known colleagues.<\/li>\n<li>Implement <a href=\"https:\/\/lg-staging.lougcloud.com\/news\/how-to-setup-mfa-multifactor-authentication-in-microsoft-365\/\">Multi-Factor Authentication (MFA)<\/a> \u2013 Require MFA for all employees to prevent unauthorized access to accounts, even if credentials are compromised.<\/li>\n<li>Check with the sender \u2013 Implement security policies that require verification before accessing shared files, ensuring employees double-check with senders before opening unexpected links.<\/li>\n<li>Monitor &#038; Analyze Account Activity \u2013 Set up alerts for unusual login locations, rapid file sharing, or mass emails being sent from an account.<\/li>\n<li>Foster a Security-First Workplace Culture \u2013 Employees should feel comfortable reporting suspicious emails without fear of repercussions. The quicker an attack is identified, the less damage it can cause.<\/li>\n<li>Device Authentication \u2013 Mobile Device Management (MDM) and Zero-Trust Network Access (ZTNA) require device authentication to access services, effectively adding another factor to multi-factor authentication (MFA). With device authentication, the device itself serves as a verification factor, ensuring the user\u2019s identity.<\/li>\n<\/ol>\n<h2>Strengthen Your Cybersecurity with Louisville Geek<\/h2>\n<p>Adversary in the middle phishing attacks are becoming more sophisticated. Organizations must stay proactive by prioritizing cybersecurity awareness training and implementing strong security measures to prevent these threats from spreading.<\/p>\n<p>If you want to learn how to protect your organization from this type of attack, <a href=\"https:\/\/lg-staging.lougcloud.com\/contact-us\/\">contact Louisville Geek<\/a>. Our <a href=\"https:\/\/lg-staging.lougcloud.com\/it-services\/it-security-solutions\/\">IT security solutions<\/a> go beyond just training\u2014we can evaluate your entire <a href=\"https:\/\/lg-staging.lougcloud.com\/news\/why-cybersecurity-ecosystem-matters-integrated-security-tools\/\">cybersecurity ecosystem<\/a>, identify vulnerabilities, and implement strategies to safeguard your business against emerging threats. Our experts can help strengthen your cybersecurity defenses and provide the necessary training to keep your business safe.<\/p>\n<\/div><\/section><\/p><\/div>\n<\/div><\/div><\/div><!-- close content main div --><\/div><\/div><div id='newsletter-cta'  class='avia-section av-av_section-bf71739d329529c36a7aa81417d127ce main_color avia-section-default avia-no-border-styling  avia-builder-el-4  el_after_av_one_full  avia-builder-el-last  avia-bg-style-scroll container_wrap fullsize'  ><div class='container av-section-cont-open' ><div class='template-page content  av-content-full alpha units'><div class='post-entry post-entry-type-page post-entry-7767'><div class='entry-content-wrapper clearfix'>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-av_one_half-1e26125d131ba13f1accaa8241be1528\">\n.flex_column.av-av_one_half-1e26125d131ba13f1accaa8241be1528{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-av_one_half-1e26125d131ba13f1accaa8241be1528 av_one_half  avia-builder-el-5  el_before_av_one_half  avia-builder-el-first  first flex_column_div av-zero-column-padding  '     ><section  class='av_textblock_section av-av_textblock-564067357eb74c20cdd60b282c9b50bd '  ><div class='avia_textblock' ><p>Get expert IT tips, industry insights, and updates on the latest managed IT solutions for your business. Stay ahead of the competition and ensure your IT systems are optimized with Louisville Geek&#8217;s trusted services.<\/p>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-av_one_half-da852e3ef3e55b029d2629c41a20524d\">\n.flex_column.av-av_one_half-da852e3ef3e55b029d2629c41a20524d{\nborder-radius:0px 0px 0px 0px;\npadding:0px 0px 0px 0px;\n}\n<\/style>\n<div  class='flex_column av-av_one_half-da852e3ef3e55b029d2629c41a20524d av_one_half  avia-builder-el-7  el_after_av_one_half  avia-builder-el-last  flex_column_div av-zero-column-padding  '     ><section  class='av_textblock_section av-av_textblock-c9ceb3991774324a78e9572e99ab6c4d '  ><div class='avia_textblock' ><h3>Stay updated by signing up for our newsletter<\/h3>\n<\/div><\/section><br \/>\n<\/p><\/div>\n\n","protected":false},"excerpt":{"rendered":"<p>Adversary in the middle phishing attacks use compromised accounts to send fraudulent shared document links, leading to fake login pages that steal session tokens. These attacks bypass MFA and traditional security filters. Learn how to detect and prevent them with Louisville Geek\u2019s expert IT security solutions. <\/p>\n","protected":false},"author":1,"featured_media":7768,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-7767","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-news"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Adversary in the Middle Phishing | Protect Your Business<\/title>\n<meta name=\"description\" content=\"Learn how adversary in the middle phishing attacks steal session tokens and bypass security. Protect your business with Louisville Geek\u2019s IT security solutions.\" \/>\n<meta name=\"robots\" content=\"noindex, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Adversary in the Middle Phishing | Protect Your Business\" \/>\n<meta property=\"og:description\" content=\"Learn how adversary in the middle phishing attacks steal session tokens and bypass security. Protect your business with Louisville Geek\u2019s IT security solutions.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/lg-staging.lougcloud.com\/?p=7767\" \/>\n<meta property=\"og:site_name\" content=\"Louisville Geek\" \/>\n<meta property=\"article:published_time\" content=\"2025-03-27T15:41:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-07-24T16:57:05+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"1040\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"lg_admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"lg_admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Adversary in the Middle Phishing | Protect Your Business","description":"Learn how adversary in the middle phishing attacks steal session tokens and bypass security. Protect your business with Louisville Geek\u2019s IT security solutions.","robots":{"index":"noindex","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Adversary in the Middle Phishing | Protect Your Business","og_description":"Learn how adversary in the middle phishing attacks steal session tokens and bypass security. Protect your business with Louisville Geek\u2019s IT security solutions.","og_url":"https:\/\/lg-staging.lougcloud.com\/?p=7767","og_site_name":"Louisville Geek","article_published_time":"2025-03-27T15:41:37+00:00","article_modified_time":"2025-07-24T16:57:05+00:00","og_image":[{"width":1200,"height":1040,"url":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack.jpg","type":"image\/jpeg"}],"author":"lg_admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"lg_admin","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/lg-staging.lougcloud.com\/?p=7767#article","isPartOf":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=7767"},"author":{"name":"lg_admin","@id":"https:\/\/lg-staging.lougcloud.com\/#\/schema\/person\/3be0d57bc8c8a3746bb75ce4d733211c"},"headline":"Adversary in the Middle Phishing: How to Protect Your Business","datePublished":"2025-03-27T15:41:37+00:00","dateModified":"2025-07-24T16:57:05+00:00","mainEntityOfPage":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=7767"},"wordCount":1326,"publisher":{"@id":"https:\/\/lg-staging.lougcloud.com\/#organization"},"image":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=7767#primaryimage"},"thumbnailUrl":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack.jpg","articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/lg-staging.lougcloud.com\/?p=7767","url":"https:\/\/lg-staging.lougcloud.com\/?p=7767","name":"Adversary in the Middle Phishing | Protect Your Business","isPartOf":{"@id":"https:\/\/lg-staging.lougcloud.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=7767#primaryimage"},"image":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=7767#primaryimage"},"thumbnailUrl":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack.jpg","datePublished":"2025-03-27T15:41:37+00:00","dateModified":"2025-07-24T16:57:05+00:00","description":"Learn how adversary in the middle phishing attacks steal session tokens and bypass security. Protect your business with Louisville Geek\u2019s IT security solutions.","breadcrumb":{"@id":"https:\/\/lg-staging.lougcloud.com\/?p=7767#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/lg-staging.lougcloud.com\/?p=7767"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/lg-staging.lougcloud.com\/?p=7767#primaryimage","url":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack.jpg","contentUrl":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2025\/03\/adversary-in-the-middle-phishing-attack.jpg","width":1200,"height":1040,"caption":"Illustration of an adversary in the middle phishing attack using a fake login page to steal session tokens."},{"@type":"BreadcrumbList","@id":"https:\/\/lg-staging.lougcloud.com\/?p=7767#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/lg-staging.lougcloud.com\/"},{"@type":"ListItem","position":2,"name":"Adversary in the Middle Phishing: How to Protect Your Business"}]},{"@type":"WebSite","@id":"https:\/\/lg-staging.lougcloud.com\/#website","url":"https:\/\/lg-staging.lougcloud.com\/","name":"Louisville Geek","description":"Empowering Local Businesses and National Enterprises with Comprehensive IT Services","publisher":{"@id":"https:\/\/lg-staging.lougcloud.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/lg-staging.lougcloud.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/lg-staging.lougcloud.com\/#organization","name":"Louisville Geek","url":"https:\/\/lg-staging.lougcloud.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/lg-staging.lougcloud.com\/#\/schema\/logo\/image\/","url":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2019\/10\/lougeek_full_logo-black-1.png","contentUrl":"https:\/\/lg-staging.lougcloud.com\/wp-content\/uploads\/2019\/10\/lougeek_full_logo-black-1.png","width":1671,"height":506,"caption":"Louisville Geek"},"image":{"@id":"https:\/\/lg-staging.lougcloud.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/lg-staging.lougcloud.com\/#\/schema\/person\/3be0d57bc8c8a3746bb75ce4d733211c","name":"lg_admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/6e9e6411eb9b94c27ad6dcf6eeea2a67959e86f4aa3ee1cc1b61e042286e2d35?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/6e9e6411eb9b94c27ad6dcf6eeea2a67959e86f4aa3ee1cc1b61e042286e2d35?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/6e9e6411eb9b94c27ad6dcf6eeea2a67959e86f4aa3ee1cc1b61e042286e2d35?s=96&d=mm&r=g","caption":"lg_admin"},"url":"https:\/\/lg-staging.lougcloud.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/posts\/7767","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7767"}],"version-history":[{"count":3,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/posts\/7767\/revisions"}],"predecessor-version":[{"id":7770,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/posts\/7767\/revisions\/7770"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=\/wp\/v2\/media\/7768"}],"wp:attachment":[{"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7767"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7767"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lg-staging.lougcloud.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7767"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}