A man-in-the-middle attack, often abbreviated as MITM, is one of the most quietly dangerous forms of cybercrime targeting Australians today. It works exactly as the name suggests: an attacker positions themselves between two communicating parties, intercepting and sometimes altering data in transit, without either side realising anything is wrong. You might think you're logging into your bank. The attacker knows you are too, and they're reading every keystroke.
What actually happens during a MITM attack
The attack has two core phases: interception and, in many cases, decryption. In the interception phase, the attacker finds a way to insert themselves into the communication channel. In the decryption phase, they strip away any protection on the data so they can read or manipulate it.
The most common interception method is a rogue Wi-Fi hotspot. An attacker sets up a network named something convincing, like "Airport_Free_WiFi" or "Cafe_Guest," and waits for people to connect. Once you're on their network, all your unencrypted traffic passes directly through their device. It's trivially simple to execute, and the victim sees nothing unusual.
Another method is ARP spoofing. ARP stands for Address Resolution Protocol, the system that maps IP addresses to physical hardware addresses on a local network. An attacker sends falsified ARP messages to a local network, tricking devices into sending their traffic to the attacker's machine rather than the legitimate router. This works on home networks, office networks, and anywhere else devices share a local connection.
DNS spoofing is a third route. Rather than intercepting the traffic itself, the attacker corrupts the DNS lookup so that when you type a real web address, your device is directed to a fake server instead. Understanding how DNS actually works makes it much easier to see why this kind of attack is so effective: most users never question where a website actually lives.
Who gets targeted, and where
MITM attacks concentrate wherever large numbers of people use shared, unprotected networks. Public Wi-Fi is the obvious hotspot. Airports, shopping centres, hotels, and cafes across Australia are prime hunting grounds. The attacker doesn't need sophisticated equipment. A laptop, a wireless adapter, and freely available software are enough.
Corporate networks aren't immune either. An attacker with physical access to a building, or who has compromised a device already inside the network, can intercept internal traffic just as easily. Financial services firms, law firms, and healthcare providers are attractive targets because the data passing through their networks carries high value.
Individuals are also targeted during online transactions. If your connection to a shopping site or banking portal isn't properly secured, an attacker can capture login credentials, session tokens, and payment details.
How attackers get around encryption
You might assume that HTTPS protects you. It does, but only when it's implemented correctly and when you pay attention to the signals your browser gives you. Attackers use a technique called SSL stripping, first demonstrated publicly by security researcher Moxie Marlinspike in 2009, to downgrade a connection from HTTPS to plain HTTP without the user noticing. The site appears to load normally. The padlock vanishes from the address bar, but many users never check.
SSL hijacking is more aggressive. Here the attacker intercepts the initial connection attempt and presents their own certificate to your browser, acting as a proxy between you and the real site. If the certificate isn't issued by a trusted authority, your browser raises a warning. Dismissing that warning is one of the most dangerous habits in everyday internet use.
This is directly connected to why encryption matters so much: a properly encrypted connection, verified by a legitimate certificate chain, is genuinely hard to break. The attacks above work because they intercept the connection before encryption is fully established, or because users override security warnings.
Real-world consequences
The outcomes of a successful MITM attack range from bad to catastrophic. Stolen credentials can drain a bank account within minutes of capture. Session tokens let an attacker impersonate you on any platform without needing your password at all. Intercepted business communications can expose commercial strategies, legal advice, or intellectual property.
In 2015, security researchers demonstrated a MITM attack against a major hotel chain's Wi-Fi network, affecting guests across properties in 29 countries. In 2017, Belgian security researcher Mathy Vanhoef published the KRACK attack, which exploited weaknesses in the WPA2 Wi-Fi protocol to allow MITM-style interception on networks that should have been protected. Both cases showed that the threat applies to infrastructure most people consider trustworthy.
How to protect yourself
Use a VPN on any network you don't fully control. A VPN encrypts your traffic before it leaves your device, which means even an attacker who successfully intercepts it sees only scrambled data. If your VPN drops unexpectedly, a VPN kill switch cuts your internet connection immediately, preventing any unprotected data from leaking through.
Keep HTTPS enforcement on. Most modern browsers support HTTPS-only mode, which refuses to load pages over unencrypted connections. Enable it. Never click through certificate warnings. A browser warning that a site's certificate is invalid or untrusted is not a nuisance: it's a signal that something is wrong with the connection itself.
Enable two-factor authentication on every account that supports it. Even if an attacker captures your password through a MITM attack, a second factor tied to your phone makes the credential far less useful. Keep your device software and router firmware current. WPA2 vulnerabilities like KRACK have been patched, but only on devices that applied the update.
On public Wi-Fi, avoid logging into banking or email accounts unless you're behind a VPN. Prefer mobile data when security matters. It's a smaller attack surface than a shared wireless network, and the infrastructure is harder for an opportunistic attacker to compromise.
Why MITM attacks stay relevant
Despite decades of public awareness, MITM attacks remain effective because they exploit human behaviour as much as technical weaknesses. People connect to open networks without thinking. They dismiss certificate errors to reach a site quickly. They assume the padlock means safety even when it doesn't.
Awareness is the first defence. Knowing what a MITM attack is, and where it tends to happen, changes how you evaluate every network connection you make. That's not paranoia. It's the same logic that stops you from handing your wallet to a stranger and asking them to keep it safe while you order coffee.