Understanding AitM attacks in Entra ID: Attack mechanics, and defensive measures

This CERT Intrinsec analysis details how AiTM (Adversary-in-the-Middle) attacks proxy Microsoft Entra ID authentication to capture session tokens and bypass MFA, surveys common delivery vectors and proxy toolkits (e.g., Evilginx, Modlishka, Muraena and commercial phishing-as-a-service), and recommends a layered defense—comprehensive Conditional Access coverage, phishing-resistant MFA (FIDO2/passkeys/CBA), Token Protection, Continuous Access Evaluation and Identity Protection—while noting licensing and operational constraints.