Updated
What Is a Man-in-the-Middle Attack and How Can You Avoid One?
Head of Product & Co-Founder
Reviewed by Argjent Sahiti
CTO
A man-in-the-middle (MITM) attack is when someone secretly gets between you and a website, app, Wi-Fi network or person, so they can read or change what you send. You lower the risk by sticking to HTTPS sites, keeping important accounts off open public Wi-Fi, using a VPN on public networks and turning on multi-factor authentication.
Key takeaways
- A man-in-the-middle attack puts someone between you and a service so they can read or change what you send.
- Browser certificate warnings, a site switching from HTTPS to HTTP and unexpected login redirects are common warning signs.
- A fake public Wi-Fi network named like a café, airport or hotel hotspot is one of the simplest ways in.
- Avoid logging in or paying on open Wi-Fi, and use a VPN to encrypt your traffic on public networks.
- Reverse-proxy phishing pages can steal session cookies and sometimes get around multi-factor authentication.
This guide covers how the attacks work, the warning signs, the common types with real cases, and the steps that protect you.
What is a man-in-the-middle attack?
In practice, a MITM attack lets someone see your login details, card numbers, account data or private messages as they travel. Nothing looks different on your end. You think you're talking straight to a trusted website, network or person, and the attacker quietly passes everything along in between.
"Man-in-the-middle" is still the common name, but some organisations and security experts prefer more neutral or precise terms: on-path attack, adversary-in-the-middle (AITM), machine-in-the-middle or manipulator-in-the-middle. Those fit better when the thing in the middle is a bot, a device or malicious software rather than a person.
What is the purpose of a man-in-the-middle attack?
Usually to get information that should stay private: login details, payment information, personal data or messages.
Sometimes the attacker wants to change that information as well as read it. They might swap the bank details on an invoice, send you to a fake website or use stolen credentials to get into an account. Either way, the attack rides on a connection you trust, and that's exactly why it's hard to notice.
> Also read: Understand the different types of exposure
How does a man-in-the-middle attack work?
Picture someone standing unseen between you and the person you're talking to. Your message gets to them first. They read it, then pass it on, and neither of you knows.
Online, that someone can sit between you and a website, an app, an email account or a Wi-Fi network. The connection looks fine, but the attacker may be able to see or alter what goes through it.
Say you join what looks like a café's free Wi-Fi. If the network is fake or unsecured, an attacker can watch your traffic, and the moment you log in somewhere or type card details, they can grab them. A MITM attack can also start with a phishing link, a fake website or malware in your browser. Once in the middle, the attacker can collect logins, payment data or private messages, send you to fake pages, or change information before it reaches the person it was meant for.
Expand> Also read: How to Protect Yourself and Your Data from Internet Hackers
Signs of a man-in-the-middle attack
Because the connection looks normal, these attacks are hard to catch. Signs that your data might be intercepted or rerouted:
- Browser warnings about an unsafe or invalid security certificate
- A website switching from HTTPS to HTTP
- Unexpected redirects to login or payment pages
- Public Wi-Fi networks with names similar to trusted ones
- Frequent connection drops or unusually slow browsing
- Login alerts from unknown devices or locations
- Messages, emails or transactions that seem to have been changed
No single sign proves an attack. Each one is still worth stopping for.
Common types of man-in-the-middle attacks
The methods differ. The aim doesn't: catch information while it moves between two parties who trust each other.
| Type | How it works | What the attacker gets |
|---|---|---|
| Email hijacking | The attacker gets into a company's or organisation's email account and monitors conversations. | A trusted account to send convincing messages from, for example to change payment details or ask for transfers to a fraudulent account. |
| Session hijacking | The attacker steals the session cookie that tells a website you're logged in. | The ability to act as you without your password, with access to account information or payment details. |
| Wi-Fi eavesdropping | The attacker runs or monitors an unsecured or fake public Wi-Fi network, often named like a trusted business or hotspot in an airport, café, hotel or city centre. | Login details, payment information or personal data you enter while connected. |
Table: Three common man-in-the-middle attacks compared
What is an example of a man-in-the-middle attack?
The textbook example is a fake public Wi-Fi network named to look like it belongs to a café, airport or hotel. Connect to it and the attacker sits between you and every site or app you use. From there they can see your logins, collect card details, read private messages, push you to fake websites and capture your session data.
Real-world examples of MITM attacks
DigiNotar certificate breach. In 2011, hackers broke into the Dutch certificate authority DigiNotar and issued fraudulent SSL certificates for major websites, including Google. A rogue google.com certificate was used to intercept users who believed their connection was secure.
Lenovo Superfish adware. Some Lenovo computers shipped with pre-installed adware called Superfish. It used a self-signed root certificate to intercept encrypted HTTPS traffic and inject targeted ads. The US Cybersecurity and Infrastructure Security Agency (CISA) warned that Superfish left users open to HTTPS spoofing, which is precisely the opening a man-in-the-middle attacker needs.
Reverse-proxy phishing. In more advanced attacks, criminals put a fake login page in front of the real one and collect passwords, session cookies and other account data as you sign in. This can sometimes get around multi-factor authentication.
How to prevent a man-in-the-middle attack
Most of the protection comes down to secure connections, updated devices and caution on public networks.
Step 1: Use secure websites
Before typing personal information, check that the site uses HTTPS and the browser shows a padlock. Never enter logins, card numbers or other sensitive data on a site that only uses HTTP.
Step 2: Avoid unsafe public Wi-Fi
Public Wi-Fi is handy and often insecure. Don't log in to important accounts or pay for anything on open or unfamiliar networks.
Step 3: Use a VPN on public networks
A VPN encrypts your connection, so even on a compromised network an attacker has a much harder time reading your traffic.
A VPN is not the same as your browser's private window. Here's what incognito mode does and doesn't hide.
Step 4: Turn on multi-factor authentication
Multi-factor authentication (MFA) adds a second step when you log in. CISA's MFA guidance explains how to set it up and which methods are strongest. If an attacker gets your password, MFA still stands in the way.
Step 5: Keep your devices updated
Updates often patch security holes. Keep your phone, computer, browser, apps and antivirus up to date so malware has fewer known weaknesses to use.
Step 6: Be careful with links and login pages
Phishing links lead to fake sites that look real. Check the web address before you type anything, and be wary of links in unexpected emails, texts or pop-ups.
Step 7: Use encrypted services
Pick services that use strong encryption for messaging, email, payments and logins. Encryption keeps your data unreadable while it travels between you and the service.
Questions
Can a VPN protect me from a man-in-the-middle attack?
It can help. A VPN encrypts your internet traffic, which makes it harder for attackers to read your information even if the network is compromised. Combine it with HTTPS websites and multi-factor authentication.
Is it safe to use public Wi-Fi?
Not always. Attackers can set up fake or unsecured networks that look like a café, airport or hotel hotspot and monitor what you do. Avoid logging in to important accounts or making payments on open or unfamiliar networks.
Can someone get into my account without my password?
Yes, through session hijacking. If an attacker steals the session cookie that keeps you logged in, they may be able to act as you without needing your password.
What is another name for a man-in-the-middle attack?
Some security experts prefer on-path attack, adversary-in-the-middle (AITM), machine-in-the-middle or manipulator-in-the-middle. These terms fit cases where the thing in the middle is a bot, device or malicious software rather than a person.
Does HTTPS stop man-in-the-middle attacks?
It helps, so check for HTTPS and the padlock before entering personal information. Take certificate warnings seriously, though: in the DigiNotar breach, hackers created fraudulent certificates for major websites, including Google.
Author
Anthon WanslandHead of Product & Co-Founder
Shapes the Serus product — from the first address-removal service to the platform it is today.
Reviewed by
Argjent Sahiti
