We always recommend multi-factor authentication (MFA). It’s an important layer of protection. But here’s the truth: MFA alone is no longer enough.

Attackers are getting smarter and sneakier. One of the fastest growing threats right now is the Adversary-in-the-Middle (AiTM) attack, and it’s especially targeting Microsoft 365.

These attacks bypass MFA. They don’t drop malware. Instead, they use legitimate tools and stolen session tokens to “live off the land.” That means they can look just like normal users inside your environment, making them extremely hard to detect.

Real-World Example: A Small Plumbing Company Nearly Shut Down

A friend of mine owns an MSP, and just recently he got a call from a plumbing company with 10 employees. They were in a panic because they couldn’t send emails, everything just sat in the sent folder.

After investigating, my friend found that one of their staff had clicked on what looked like a DocuSign email. No password was entered. No credentials were typed in. Yet attackers still managed to slip inside their Microsoft 365 environment.

Once in, the attackers configured a separate domain and started sending malicious emails on behalf of the company. Operations came to a grinding halt.

Within an hour, my friend’s team had:

• Removed the attackers from the environment
• Rolled out their security monitoring software
• Reset all passwords and MFA with stronger rules
• Started the staff on their first cybersecurity training session

Here’s the kicker: this plumbing company had no cybersecurity in place before this incident. Now, they’ve got the protections, training, and monitoring needed to prevent this from ever happening again.

You Can’t Do This Alone

The bad guys are no longer just brute-forcing passwords or sending obvious spam. They’re using advanced, stealthy methods that go around your defenses instead of through them.

MFA is a must, but it’s not enough on its own. You need a cybersecurity partner to continuously monitor, detect, and respond to these evolving threats. The cost of doing nothing is a business that can grind to a halt in minutes. The cost of being protected? For small businesses, it can sometimes be less than what you’re already paying for phone or internet service.

If you’re not sure where your business stands, let’s talk.

Don’t wait until you’re the next victim of an AiTM attack.