Login fraud is happening now: lessons from one year of AitM detection

Since January 2024, Attic has been providing a free form of login protection, designed to detect attacks known as “Adversary in the Middle” (AiTM). When they first introduced this service, they were genuinely shocked by how frequently organisations were actually being targeted. While the scale of the issue matches what occasionally makes the headlines, the term AitM is highly technical and often left out of public explanations. So whenever you read about a phishing link or a compromised session, you can safely assume it is most likely an AitM attack.

To give a clearer picture of what we see in practice, we decided for the first time to publish this threat report, covering the period July 2024 – June 2025. Click here to read the document.

Over the reporting period, the number of installations increased. We calculated, month by month and quarter by quarter, how many connected companies experienced at least one detection at that point in time. A detection means that the fake login page was actually visited (someone clicked the link) and that the email address was entered afterwards. In other words: the individual was successfully deceived.

On average, 28% of connected tenants had at least one AitM detection per quarter. Of the 1,592 visits to AitM sites, the majority came from Microsoft scanners, but 492 were genuine clicks by people. Each quarter, around 20% of organisations experienced at least one such incident. Looking at the entire year, 52% of organisations were hit at least once (173 out of 334).

The number of successful deceptions clearly shows that employees still struggle to recognise fake login pages. This underlines the importance of user awareness training and the addition of visual security indicators.

In the Netherlands, 44% of clicks occurred when the victim was not connected to a corporate network (with 23% taking place via private or mobile connections). This means that employees were not protected by their organisation’s network security.

As a result, protection needs to focus far more on the identity of the employee. After all, logging in is often the only barrier standing between an attacker and access to sensitive data.

Click here to read the full blog.