A man in the middle attack (MITM) is an attack where someone secretly intercepts the traffic between you and a website, app or service — reading, and sometimes altering, everything that passes. You think you are talking to your bank; in reality your connection runs through the attacker first, like a mail carrier who opens every letter, copies it, reseals it, and forwards it on. The victim rarely notices, because the connection keeps working normally.
TL;DR
- A man in the middle attack intercepts traffic between you and the service you meant to reach.
- The classic routes are fake Wi-Fi hotspots, compromised routers and DNS poisoning.
- HTTPS is the main technical defence: a site without a valid certificate in 2026 is a red flag by itself.
- Modern browsers make most MITM attempts visible as certificate warnings — never click through one.
- MFA and passkeys limit the damage even when traffic is intercepted.
What a man in the middle attack means in plain terms
Every time your device talks to a server — loading a page, checking email, uploading a file — the conversation travels through network equipment you do not control: the office router, the airport hotspot, your internet provider. A man in the middle attack places the attacker at one of those points so they can watch the conversation. If the traffic is unencrypted, they read everything: usernames, passwords, message content. If it is encrypted but the attacker can trick your device into trusting them, they can unscramble and re-encrypt it on the fly.
The name describes the position, not the tool. Related attacks such as pharming use the same position to redirect you to fake sites, and DNS poisoning is one of the ways an attacker gets into that position in the first place.
How a man in the middle attack actually runs
- Positioning. The attacker gets between you and the internet. Common routes: a fake Wi-Fi hotspot with a convincing name ("Airport_Free_WiFi"), a compromised router, ARP spoofing on a shared network, or poisoned DNS answers that resolve real domains to the attacker's server.
- Interception. Traffic starts flowing through the attacker. Unencrypted traffic (plain HTTP) is readable as-is.
- Relay and capture. For encrypted traffic, the attacker either passes it along untouched (capturing only metadata) or attempts a downgrade or certificate trick to decode it.
- Harvesting or altering. Credentials, session cookies and form data are captured — or the attacker rewrites the page, for example by changing a bank account number before the payment instruction reaches its destination.
Where man in the middle attacks happen
| Setting | How the MITM happens | The tell |
|---|---|---|
| Public Wi-Fi | A rogue hotspot with a familiar name captures all traffic | A hotspot with no password, or a name that nearly matches the real one |
| Office network | A compromised router or ARP spoofing on the LAN | Devices redirect to odd pages, or certificates warnings appear on trusted sites |
| Home Wi-Fi | Default router passwords let attackers change DNS settings | Slow internet plus strange redirects |
| Malware on device | Local proxy silently reroutes traffic | Security warnings the user has learned to dismiss |
| Email or chat | An attacker sits inside a compromised account and relays both sides of a conversation | Sudden change of bank details mid-thread — the payment-fraud variant, see what is invoice fraud |
That last row matters most for small businesses: the "man in the middle" does not always sit on the network. An attacker who has compromised a supplier's mailbox relays your invoices — and changes the bank account on them. Same attack shape, different medium.
How to defend against man in the middle attacks
| Layer | Control | What it stops |
|---|---|---|
| Encryption | HTTPS everywhere, enforced by the browser | Plain-traffic reading on any network |
| Certificates | Never proceed past a certificate warning | Fake-site relay and certificate tricks |
| Wi-Fi | Never use open hotspots for work; use phone tethering or a VPN | Rogue-hotspot capture |
| Infrastructure | Unique router admin passwords, current firmware, no remote admin | Network-level interception and DNS poisoning |
| Identity | MFA and passkeys on every account | A captured password or session alone is not enough |
| Payments | Verify bank-detail changes by phone on a known number | The mailbox MITM that redirects payments |
HTTPS has quietly done most of the heavy lifting here: in 2026 the large majority of web traffic is encrypted, so a passive listener on a café Wi-Fi sees far less than they did a decade ago. The residual risk concentrates on unencrypted services, lookalike Wi-Fi networks, and the human layer — people clicking through the one warning that was actually trying to protect them.
Why staff awareness still decides the outcome
The technical defences fail last, not first: almost every successful MITM against a person involves someone ignoring a warning or connecting to the wrong network. Cyber Aware's security awareness training covers public Wi-Fi discipline, certificate warnings and payment-verification habits in the monthly modules, and human risk reporting shows whether those habits are sticking.
FAQ
What is a man in the middle attack? An attack where a third party secretly intercepts — and possibly alters — the traffic between you and a website or service. You believe you are communicating directly with the real service while everything passes through the attacker first.
What is the difference between MITM and phishing? Phishing tricks you into visiting a fake site or handing over details; MITM sits between you and the real service and captures what flows. Pharming is a hybrid: it redirects you to a fake site by corrupting the address lookup, so no click is even needed.
Is public Wi-Fi safe in 2026? With HTTPS everywhere, casual eavesdropping is much harder than it used to be — but rogue hotspots still capture traffic for unencrypted services and for anyone who dismisses certificate warnings. For work, use your phone's hotspot or a VPN instead of open Wi-Fi.
Does HTTPS stop man in the middle attacks? Mostly. Valid HTTPS certificates make undetected interception extremely difficult, because the attacker cannot forge your bank's certificate. That is exactly why certificate warnings are serious: they are the browser telling you a MITM may be in progress.
How do attackers use MITM to steal money from businesses? Two main routes: intercepting a payment session (altering the account number as a payment instruction passes through), or the mailbox variant — relaying an invoice thread and swapping the bank details before the invoice reaches you. Verify every bank-detail change by phone on a number you already had.
What should I do if I saw a certificate warning on a site I use daily? Stop, do not proceed, and report it. A warning on a site that normally shows none means either the network you are on is intercepting traffic or something is intercepting your device — both are reportable incidents.
One last thing
Check how your team connects when working from cafés, airports and client sites this week. If the answer is "whatever free Wi-Fi is around", a $0 policy change — phone tethering or a VPN for all work devices — removes the most common MITM route in one step. If you cannot see which staff behaviours are actually risky, that is a gap assessment conversation.