Identity Based Attacks: Breaking Down Adversary-in-the-Middle Phishing

Compromised identities are no longer just about fraud. They can be used to establish access into your corporate environments, including SaaS applications and remote access services like VPNs.

As we've strengthened accounts with multi-factor authentication, adversaries are increasingly targeting one-time passcodes from authenticator apps or sent to our phones via text message or phone call. These attacks are known as adversary-in-the-middle phishing and trick the user into submitting their credentials and one-time password to a phishing site.

Watch this video for more information and a real-world example of an adversary-in-the-middle phishing attack on an eSentire customer to see how our SOC Cyber Analysts rapidly identified and responded to the compromised identity attack to prevent business disruption.