AiTM Phishing Now #1 Break-In Method for Law Firms

How the attack worked

Threat intelligence covering the legal sector found that adversary-in-the-middle (AiTM) phishing has become the most common way attackers gain initial access to law firms, responsible for 28.57% of initial access events. Instead of simply stealing a password, AiTM pages proxy the real authentication flow. A user enters credentials and completes an MFA prompt as normal, but the attacker sits in the middle of that exchange and captures the resulting session cookie, gaining access without ever needing to defeat MFA directly.

A second common pattern used fake browser or portal errors, often called ClickFix-style lures, where a message claims a document viewer, e-filing system, or court portal needs urgent attention. These errors were elevated in legal incidents (13.39%) compared to cross-industry rates (8.77%), and the technique primarily delivered a remote access trojan when victims followed the on-screen 'fix' steps.

Why it succeeded

These attacks succeeded by exploiting two things at once: technical trust in MFA and human urgency. Because the login flow looks legitimate and MFA is genuinely completed, users have little reason to suspect anything is wrong. Layered on top of that, deadline pressure specific to legal work, such as court filings, made staff more likely to act quickly on an unexpected error rather than pause to verify it. Microsoft Teams abuse was also noted as a growing entry point, appearing in 6.25% of cases, nearly double the cross-industry figure.

What to watch for

• Login pages reached via unexpected or unsolicited links, even if they request MFA normally
• Sudden 'urgent' error messages while accessing document viewers, e-filing systems, or court portals
• Prompts urging users to run a fix, script, or download to clear a blocking error
• Session activity that continues even when the user did not initiate a new login
• Any single phishing-as-a-service pattern driving a large share of compromises, since one platform was linked to over half of AiTM-related compromises in the sector

Building resistance

Because 86% of observed incidents progressed beyond initial access into active intrusion, with ransomware intrusion at 23%, stopping AiTM phishing at the entry point matters. Recommended defenses include deploying phishing-resistant MFA such as FIDO2 keys and passkeys, adopting conditional access policies that evaluate device health and location, and monitoring identity platform logs for anomalous session activity. Staff should also be trained to verify document portal or court filing issues through a known bookmark or official channel rather than following in-page prompts, especially under deadline pressure.

What is AiTM phishing and why does it bypass MFA?

AiTM (adversary-in-the-middle) phishing proxies the real login process, so even when a user enters correct credentials and completes an MFA challenge, the attacker captures a valid session cookie and can access the account without needing the password or MFA code again.

Why are law firms specifically targeted with these attacks?

A legal-sector threat intel report found AiTM phishing was the most common initial access method in the legal sector, accounting for 28.57% of initial access events, often using deadline-driven lures tied to court filings and document portals.

What is Tycoon2FA and how does it relate to this attack?

Tycoon2FA is a phishing-as-a-service platform that was attributed as driving 52.3% of AiTM-related account compromises in the legal sector across 2025.

What happens after attackers gain initial access this way?

In 86% of observed incidents, activity progressed beyond initial access into active intrusion, and ransomware intrusion occurred in 23% of cases.