SimSmsBox Quick answer: An adversary-in-the-middle (AiTM) attack is advanced phishing where a fake site relays everything you type — including your one-time code — to the real site in real time, then steals your logged-in session. Because it captures the code the instant you enter it, AiTM can defeat SMS and app-based OTP. The reliable defense is phishing-resistant login like passkeys or hardware keys, which are cryptographically bound to the real site and can’t be relayed.
Most phishing steals your password and stops there — and 2FA saves you. AiTM phishing is the scarier evolution: it sits between you and the real website, passing your credentials and your code through live, so the second factor you trusted gets swept up too. Here’s how it works and what actually stops it.
1. How AiTM defeats OTP
Classic phishing captures a password on a fake page, but hits a wall at 2FA. AiTM removes that wall with a real-time relay (a reverse proxy):
- You click a phishing link and land on a fake page that perfectly mirrors the real site.
- You enter your password — the proxy instantly forwards it to the real site.
- The real site asks for your OTP; the fake page relays that request to you.
- You enter the code — the proxy forwards it in real time, before it expires.
- The real site returns a valid session cookie, which the attacker steals to stay logged in.
Because the code is used the moment you type it, its short expiry doesn’t help. The attacker didn’t crack the OTP — they made you deliver it live.
2. Why it beats codes but not passkeys
The key difference is what a factor is bound to:
| Factor | Survives AiTM? |
|---|---|
| SMS OTP | No — relayed live |
| Authenticator app code | No — relayed live |
| Push approval | Often no — you approve the proxied login |
| Passkey / hardware key | Yes — bound to the real domain |
Any code you can read and retype can be relayed by a proxy. A passkey or hardware key is different: it cryptographically checks the actual website’s identity, so on a fake domain it simply refuses to authenticate. That’s what “phishing-resistant” means.
3. How to protect yourself
- Check the domain before entering anything — AiTM lives on look-alike URLs. If the address is off, stop.
- Use passkeys or hardware keys for critical accounts; they won’t work on a fake site, which is exactly the point.
- Be wary of login links in emails/messages — navigate to sites directly instead of clicking through.
- Watch for unexpected session prompts and re-authentication requests, and report anything suspicious.
Codes still protect you against most everyday threats like credential stuffing — AiTM is the specific case where phishing-resistant factors matter most.
4. What this means if you receive codes online
AiTM targets the login page you were tricked into visiting, not the channel your code travels on — so it’s a phishing problem, not a delivery one. Whether your code arrives on a SIM or you receive it online without a SIM, the risk is identical, and the defense is the same: only enter a code on a site you navigated to yourself and whose domain you verified.
The takeaway: SMS codes remain fine for the everyday threats they were meant to stop. For accounts where targeted phishing is a real worry, add a phishing-resistant factor — and always confirm you’re on the genuine site before entering any code, online-received or not.
FAQ
Q: Can AiTM really bypass 2FA? Yes, for code- and push-based 2FA, because it relays your code to the real site in real time. It cannot bypass passkeys or hardware keys, which are bound to the genuine domain.
Q: How do I know if a site is an AiTM fake? The biggest tell is the URL — AiTM uses look-alike domains. Always verify the address, and reach sites by typing them or using bookmarks rather than clicking links.
Q: Should I stop using SMS codes because of AiTM? No. SMS codes still stop common attacks like credential stuffing. For high-risk targets, add a phishing-resistant factor like a passkey, and stay alert to the domain you’re on.
Takeaway
AiTM phishing relays your password and one-time code to the real site in real time, stealing your session — which is why any code you can retype, including SMS, can be defeated by it. The reliable defense is a phishing-resistant factor like a passkey bound to the real domain, plus the habit of verifying the site before entering any code, however you received it.