Resources / Case studies / Stopping an AiTM phishing attack
How SNO’s 24/7 Operations Centre stopped an adversary-in-the-middle phishing attack
An employee of a multinational managed-services client was targeted by an adversary-in-the-middle (AiTM) phishing attack that captured their password and MFA code. SNO’s UK-based Operations Centre spotted the suspicious Microsoft 365 sign-in and contained the attack within 30 minutes. No data was compromised.
The attack
The phishing email reached a Los Angeles-based employee and was engineered to bypass conventional email protection. It was a two-part attack: an AiTM proxy captured the user’s credentials and MFA code, followed by malware on the user’s device. The attacker then tried to sign in to the user’s Microsoft 365 account from an unusual location in Virginia, using a Linux-based device.
How SNO responded
- Alert and investigation (22:43 UK time): the Operations Centre received an alert about the suspicious sign-in. An analyst investigated immediately and contacted the user, who confirmed it was not them
- Containment within 30 minutes: SNO blocked further sign-in attempts, revoked active sessions, removed the user’s personal email from MFA and quarantined the device
- Over the next two hours: multiple further sign-in attempts were blocked. Tests on the laptop found malware, so it was wiped and rebuilt and the user’s access restored
The result
- No data breach: fast detection and response meant no data was compromised
- Business continuity: minimal disruption to the client’s global operations
- Wider protection: other employees who had received the same phishing email were protected
- Stronger posture: post-incident analysis led to reinforced security measures
What other organisations can learn
- MFA alone does not stop AiTM attacks. Sign-in monitoring and fast session revocation matter
- Out-of-hours alerts need someone to act on them, at any time of day
- Containing the account and the device together stops a second wave
Read the full case study
The full response timeline, the security controls involved and the lessons learned. PDF, 4 pages, 2.2 MB. No form required.