How 'browser-in-the-middle' attacks steal sessions in seconds

Browser-in-the-Middle (BitM) attacks have the victim unknowingly use a transparent remote browser controlled by the attacker, letting criminals capture session tokens and bypass multi-factor authentication. University of Salento researchers Franco Tommasi, Christian Catalano, and Ivan Taurino outlined the attack in a paper for the International Journal of Information Security. Citing Google subsidiary Mandiant, the article says that once a session token is stolen, an attacker no longer needs to pass the MFA challenge, and can reach any website in seconds. The article concludes that passwords remain relevant and recommends layered defenses such as short-lived tokens, browser isolation and behavioral monitoring.