Whitepaper: AiTM Threat Report 2025

At Attic, we have been providing a free form of login protection since January 2024. With it, we detect attacks known as 'AiTM' or Adversary in the Middle.

When we started, we were genuinely shocked by how often organizations were actually affected. We know this picture matches incidents that reach the media, but because the term 'AiTM' is technical and off-putting, it almost never appears in explanations. If you read about a 'phishing link' or 'hijacked session', take our word for it — it's most likely AiTM.

To illustrate what we see, we decided to create this threat report for the first time. Covering the period July 2024 – June 2025.

Want to know more? Download the report or contact us.