Adversary-in-the-middle phishing
A phishing page that proxies the real login instead of imitating it. The victim authenticates against the genuine site through the attacker's server, completes multi-factor as normal, and the attacker keeps the resulting session cookie.
Why it matters to you
This is the technique that makes "we have MFA" an incomplete answer. The second factor is satisfied honestly and the stolen artefact is the session, not the password, so a password reset closes nothing. Revoke sessions and bind tokens to a device or a client certificate. In the logs the shape to look for is a genuine authentication from a hosting range followed immediately by activity from somewhere else on the same token.
Where we meet it
Kits are sold ready made, with per target templates traded as separate items, so an operator needs no understanding of the technique to run it. That is what moves this from a specialist attack to a commodity one.
Connected terms
Session cookie
The token that proves a browser is already logged in, copied straight out of a victim's browser by an infostealer. Replayed elsewhere it opens the account without the password and without a second factor.
Lookalike domain
A domain registered to be misread as someone else's: a swapped character, an extra hyphen, a different suffix. The cheapest piece of infrastructure in this economy and the one most often pointed at a brand.
OTP bot
An automated calling service that impersonates a bank or provider to trick victims into reading out their one-time codes. MFA bypass, sold as a subscription.
Read elsewhere
Where this term stops being vocabulary
Sherlog is where you watch it happen to you
Knowing the word is the cheap half. The platform is the half where the term arrives attached to your domain, with a timestamp and the source it came from.
More from the playbook
Business Email Compromise (BEC)
Fraud committed from inside a real mailbox: the attacker reads the thread, waits for an invoice and answers it with different bank details. No malware, no attachment, nothing for a scanner to find.
Callback phishing
An email that carries no link and no attachment, only a plausible invoice or subscription notice and a phone number to dispute it. The attack begins when the victim calls, and the person who answers walks them into installing remote access software.
Checker
A tool that tests stolen credentials against a target service in bulk and sorts the live ones from the dead. The industrialized step between a combolist and an account takeover.
ClickFix
A lure that tells the visitor the page is broken and asks them to fix it: copy this, press these keys, paste, run. The victim performs the delivery by hand, so nothing was downloaded and nothing was blocked.