Man-in-the-middle attack (MitM)

In August 2011 it emerged that the Dutch certificate authority DigiNotar had issued a rogue *.google.com certificate. It was used to intercept the Gmail traffic of about 300,000 Iranian users, and DigiNotar went bankrupt a month later. In a MitM attack, the attacker positions themselves between two entities that believe they are communicating directly, in order to eavesdrop on or modify their exchanges. Classic vectors include ARP spoofing on a local network, DNS poisoning, the creation of rogue Wi-Fi access points and, in certain contexts, the compromise of TLS certificates. End-to-end encryption and certificate pinning are the main technical countermeasures. In financial markets, the most feared variant today sits between a broker and its clearing house, or between an AI model and its production API: the attacker injects forged instructions there. For the insurer, a MitM attack often comes before wire fraud or identity theft. With an intercepted communication, the attacker impersonates a senior executive and orders a payment. The loss then falls between the cyber policy and the directors' liability policy, and cover becomes ambiguous. The concept also applies to agentic AI architectures, where an agent may receive forged instructions through a compromised channel.