A cyberattack where the attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly with each other.
A cyberattack where the attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly with each other.
Think you've been targeted?
Paste the suspicious content here for an instant analysis.
No signup · 6 detection layers · Results in seconds · Cmd+Enter
In a man-in-the-middle (MITM) attack, the attacker positions themselves between the victim and the service they're communicating with — like a postal worker reading letters before delivering them. The victim and the server both believe they're communicating directly.
MITM attacks are commonly executed on unsecured Wi-Fi networks. The attacker may set up a fake hotspot or compromise an existing network, then intercept all traffic passing through it. This can capture login credentials, financial data, and personal information.
HTTPS encryption was designed to prevent MITM attacks on the web, but sophisticated attackers can use techniques like SSL stripping (downgrading connections to unencrypted HTTP) or fake certificates to circumvent this protection.
In 2019, a banking MITM attack in Europe intercepted online banking sessions on public Wi-Fi. The attacker modified the destination bank account number in real-time during wire transfers, redirecting payments to their own accounts while showing the victim the original details on screen.