Man-in-the-Middle Attacks: How Businesses Can Protect Themselves

When you connect to a website, cloud service or business application, you normally assume you are communicating directly with that service.

But what if someone has secretly inserted themselves between you and the destination?

That is the basic idea behind a man-in-the-middle attack, increasingly also referred to as an adversary-in-the-middle attack.

An attacker may try to intercept traffic, steal credentials, capture authentication tokens or manipulate information travelling between two systems.

These attacks are harder than they once were because modern services increasingly use HTTPS, TLS and stronger authentication. But they have not disappeared.

In April 2026, the UK's National Cyber Security Centre warned that the Russian cyber actor APT28 had been exploiting vulnerable routers to hijack DNS traffic, enabling adversary-in-the-middle attacks designed to steal passwords and authentication tokens.

For businesses, that is a useful reminder that securing communications requires more than simply telling employees to look for a padlock in their browser.

What Is a Man-in-the-Middle Attack?

A man-in-the-middle attack happens when a cybercriminal secretly intercepts communication between two parties.

Normally, communication might look like:

Employee → Trusted service

During an attack, the path could effectively become:

Employee → Attacker → Trusted service

Both sides may still appear to be communicating normally.

That is what makes this type of attack dangerous.

Depending on the circumstances, the attacker may try to:

• observe information
• steal usernames and passwords
• capture authentication tokens
• redirect traffic
• alter information being transmitted
• impersonate one of the parties
• inject malicious content

Encryption makes interception significantly more difficult, but attackers frequently try to avoid attacking encryption itself.

Instead, they target the network, DNS, endpoint or user.

How Do Man-in-the-Middle Attacks Happen?

There is no single technique.

Several different attacks can create a situation where communications are intercepted.

1. Malicious or Compromised Wi-Fi

Public Wi-Fi is an obvious example.

An attacker might create a wireless network with a convincing name such as:

Hotel Guest Wi-Fi

or:

Airport Free Wi-Fi

A user connects believing it belongs to the venue.

The attacker may then be in a position to inspect or manipulate some network traffic.

Modern HTTPS significantly limits what an attacker can simply read, but malicious networks can still support other attacks involving DNS manipulation, fake login pages or attempts to redirect users.

The safest approach is to treat networks you do not control as untrusted.

2. DNS Hijacking

DNS converts names such as:

hgmssp.com

into the IP addresses computers use to find services.

If DNS is manipulated, a user may request a genuine website but be directed somewhere controlled by an attacker.

This is not theoretical.

The NCSC warned in April 2026 that APT28 had exploited vulnerable routers and changed DNS configurations, allowing the attackers to redirect traffic and attempt credential and token theft.

That highlights why businesses need to patch routers and other network-edge equipment rather than concentrating solely on Windows computers.

3. Compromised Routers

Routers sit in a powerful position because large amounts of network traffic pass through them.

If an attacker compromises one, they may be able to:

• change DNS settings
• redirect traffic
• monitor connections
• create persistence
• interfere with communications

Businesses should therefore know:

• which routers and firewalls they use
• whether firmware is current
• whether the manufacturer still supports the device
• who has administrative access
• whether default credentials have been removed

An ageing internet router should not be treated as harmless infrastructure simply because the internet still works.

4. Session Hijacking and Token Theft

Modern authentication often relies on session tokens.

After you successfully sign in — potentially including MFA — your browser or application receives a token that proves you have already authenticated.

That saves you from entering your password every time you click something.

The problem is that a stolen session token can sometimes allow an attacker to impersonate the user without repeating the original authentication process.

Microsoft warns that stolen tokens can be replayed by attackers until they expire or are revoked. Its Token Protection capability in Microsoft Entra Conditional Access is designed to reduce this risk by binding supported tokens to the device for which they were issued.

This is important because it demonstrates why:

MFA is essential, but MFA alone does not solve every identity attack.

Isn't HTTPS Supposed to Stop This?

HTTPS provides a major layer of protection.

When implemented correctly, TLS encrypts information travelling between your browser and the legitimate service.

That makes straightforward interception significantly harder.

However, attackers may target other parts of the process.

For example:

• trick the user into visiting a fake website
• compromise DNS
• compromise the endpoint
• steal an authenticated session
• compromise the router
• install malicious certificates
• exploit browser or application vulnerabilities

That is why seeing a padlock does not prove that a website is trustworthy.

It primarily indicates that the connection to that particular website is encrypted.

A phishing website can also use HTTPS.

Public Wi-Fi: Should Businesses Ban It?

Not necessarily.

Modern applications using properly configured TLS can be reasonably protected even when the underlying network is untrusted.

But employees should still use caution.

For business devices:

• keep Windows and applications patched
• use endpoint protection
• require MFA
• enable device encryption
• avoid bypassing certificate warnings
• use managed browsers and devices
• restrict access to sensitive systems where appropriate

Where an employee handles particularly sensitive systems, using mobile data or an approved secure remote-access solution may be preferable.

What About VPNs?

A VPN creates an encrypted tunnel between the device and a VPN endpoint.

This can provide useful protection when users access internal company resources remotely.

However, a VPN is not a magic shield.

It does not protect against:

• phishing
• fake websites
• malware on the device
• stolen passwords
• compromised SaaS accounts
• users approving malicious requests

Businesses should also avoid assuming that successful VPN authentication should give a user unrestricted access to everything on the company network.

Modern security models increasingly use identity, device health and application-specific access alongside traditional network controls.

MFA Still Matters

Although session theft can sometimes bypass the need to repeat MFA, this does not make MFA ineffective.

Far from it.

MFA still prevents many attacks where criminals have only obtained a username and password.

Without MFA, stolen credentials may be enough.

Businesses should therefore continue to enforce MFA across important cloud services and remote-access systems.

Where possible, organisations should also consider phishing-resistant authentication, such as passkeys or hardware-backed security methods.

Microsoft 365 and Session Protection

For Microsoft 365 environments, identity security should extend beyond simply enabling MFA.

Depending on licensing and requirements, organisations may also consider:

• Microsoft Entra Conditional Access
• compliant-device requirements
• sign-in risk policies
• user risk policies
• Token Protection
• Continuous Access Evaluation
• Microsoft Intune
• Microsoft Defender
• restricted administrator access

Microsoft's Continuous Access Evaluation can respond to important identity changes such as account disablement or password resets in near real time for supported services, while Token Protection aims to reduce token replay by binding supported session tokens to a particular device.

These controls help businesses move beyond the old model of:

Correct password + successful MFA = trust forever.

Do Not Ignore Certificate Warnings

Browsers display certificate warnings for a reason.

If an employee sees messages such as:

• connection is not private
• certificate invalid
• certificate name mismatch
• connection may not be secure

they should not simply click through because they are in a hurry.

Certificate errors can have harmless causes.

They can also indicate:

• incorrect server configuration
• expired certificates
• interception
• DNS problems
• attempts to redirect traffic

Employees should report unexpected certificate warnings to IT.

Keep Routers, Firewalls and VPN Appliances Patched

The NCSC’s 2026 APT28 warning is particularly relevant here because the attack chain involved compromised routers.

Businesses often patch laptops carefully while leaving:

• firewalls
• routers
• VPN appliances
• wireless access points
• switches

running old firmware for years.

That is a mistake.

Internet-facing network equipment is an attractive target precisely because compromising it can give attackers a strategic position inside or alongside network traffic.

Your IT provider should know what network hardware you have and whether it is still supported.

Business Email Compromise Is Related — But Different

There is another threat that can feel like a man-in-the-middle attack to the victim:

Business Email Compromise (BEC).

Imagine a business regularly emails a supplier.

An attacker compromises one party's mailbox and monitors the conversation.

At the right moment, the criminal sends or alters payment instructions.

From the victim's perspective, the attacker has effectively inserted themselves into a trusted conversation.

Technically, however, this is generally email account compromise and payment fraud, rather than interception of the network connection itself.

The NCSC classifies these scams as Business Email Compromise or business payment fraud.

That distinction matters because the controls are different.

Protecting Against Business Email Compromise

Businesses should have clear procedures for payment changes.

For example:

Never change bank details solely because an email asks you to.

Instead:

1. Contact the supplier using a phone number you already trust.
2. Verify the requested change verbally.
3. Use dual approval for significant payments where appropriate.
4. Investigate unexpected urgency or secrecy.
5. Check for suspicious mailbox forwarding rules if account compromise is suspected.

Even a genuine-looking email chain can be compromised.

Protect DNS

DNS is increasingly important to business security.

Depending on your infrastructure, useful controls can include:

• trusted DNS resolvers
• protected router configuration
• DNS filtering
• monitoring for unexpected DNS changes
• MFA on management portals
• restricted administrator access
• regular configuration backups

Router DNS settings should not suddenly change without somebody knowing why.

Keep Devices Secure

Network protection cannot compensate for an infected endpoint.

If malware controls the employee's computer, the attacker may be able to see information before encryption or after decryption.

That means businesses still need:

• endpoint detection and response
• antivirus
• patch management
• least privilege
• disk encryption
• browser security
• application control
• monitoring

The endpoint is part of the communications chain.

Train Staff to Recognise the Warning Signs

Employees do not need to understand TLS handshakes or DNS protocols.

They do need to know when something looks wrong.

Useful warning signs include:

• unexpected certificate errors
• repeated sign-in requests
• websites suddenly looking different
• unusual MFA prompts
• unexpected requests to re-enter credentials
• payment details changing unexpectedly
• familiar services redirecting elsewhere
• warnings from the browser or security software

Employees should know how to report these problems quickly.

What Should You Do If You Suspect an Attack?

If you believe a device, account or network connection may have been compromised:

1. Stop entering credentials.
2. Disconnect the affected device if necessary.
3. Contact your IT provider.
4. Reset compromised credentials from a trusted device.
5. Revoke suspicious sessions.
6. Review MFA methods.
7. Check mailbox rules.
8. Review sign-in activity.
9. Investigate DNS and router configuration if appropriate.
10. Preserve relevant logs and evidence.

Do not immediately wipe devices before understanding what happened if a serious security incident may need investigation.

Security Needs Multiple Layers

There is no single control that completely eliminates man-in-the-middle or session-hijacking attacks.

Strong protection combines:

• TLS
• MFA
• secure DNS
• patched routers and firewalls
• managed endpoints
• Conditional Access
• endpoint protection
• session protection
• monitoring
• staff awareness
• secure payment-verification procedures

If one control fails, another should make the attack harder.

How Hamilton Group Can Help

Hamilton Group can help businesses strengthen the systems that protect communications, identities and remote access.

We can assist with:

• business firewall management
• router and firmware reviews
• secure Wi-Fi
• DNS security
• Microsoft 365 security
• Microsoft Entra ID
• Conditional Access
• MFA
• Microsoft Intune
• Microsoft Defender
• endpoint protection
• VPN and remote-access security
• security monitoring
• incident response

The objective is not simply to encrypt network traffic.

It is to protect the entire path from the employee's device and identity through to the service they are trying to access.

Visit hgmssp.com or call 0330 043 0069 to speak with Hamilton Group about improving your organisation's cybersecurity.