AI-Generated AiTM Proxies Now Drive 44% of Examined Initial Access in Verizon 2026 DBIR
AI lowers creation cost and increases fidelity of fake login pages used in AiTM attacks that capture live sessions. Verizon DBIR and Mandiant telemetry confirm rapid adoption and bypass of MFA. Defenses must shift from detection of pages to protection of authenticated tokens.
Organizations should prioritize continuous session monitoring and binding authentication to device posture rather than relying on URL reputation. Next quarter will likely see commercial security tools release AI-driven page classifiers trained on known phishing kits; failure to deploy them before the next DBIR cycle will leave measurable gaps in initial-access prevention metrics.
Microsoft: AiTM-related session hijack incidents will exceed 35% of enterprise account takeovers by March 2027
Sources (3)
- [1]Verizon 2026 DBIR(https://www.verizon.com/business/resources/reports/dbir/)
- [2]Mandiant M-Trends 2025(https://www.mandiant.com/resources/m-trends)
- [3]Microsoft Defender AiTM Detections Report Q3 2026(https://www.microsoft.com/security/blog/)