Proceedings of the International scientific and practical conference ―Oxford 2026: Science and Education Today‖ (May 29-31, 2026) / Publisher website: www.naukainfo.com. - Oxford, United Kingdom, 2026. - 392 p.

186 146% compared to the previous year, and Microsoft's detection systems record about 39,000 such incidents every day [1]. Sekoia . io research for January-April 2025 identified eleven active AiTM frameworks that targeted Microsoft 365 and Google accounts , with the most common tools being Tycoon 2 FA , EvilProxy and Evilginx [2]. ( Session Hijacking ) is a type of cyber attack aimed at unauthorized access to a user's session in a web application or network service. The main types include: 1) stealing a session cookie through XSS attacks or traffic interception; 2) predictive attack on the session identifier under the condition of a weak random number generator; 3) session fixation, where the attacker forces a previously known token on the victim [3]. A significant threat is posed by attacks using reverse proxy servers - Adversary- in-the-Middle ( AiTM ). The principle of its operation is as follows: the attacker relays the communication between the victim and the legitimate resource, then the victim enters credentials and passes MFA verification, but the proxy intercepts both the password and the session cookie issued after successful authentication [4]. This type of attack allows the attacker to obtain a fully authenticated session, bypassing any confirmation factors. Detecting AiTM attacks is a non-standard task due to their "transparent middleman" nature. However, analysis of network traffic and authentication logs allows identifying characteristic signs: a sharp change in IP address between successive requests within the same session; mismatch of geolocation , User-Agent and device attributes; an abnormally short interval between successful authentication and subsequent activity from the new address. UEBA-class systems are able to detect such anomalies based on profiling typical user behavior. At the authentication level, the most effective defense against AiTM attacks is to switch to FIDO 2/ WebAuthn -compliant hardware security keys. Unlike TOTP , these devices perform cryptographically binding authentication to a specific source domain, which makes it impossible to successfully relay through a proxy; even if an attacker intercepts all traffic, he will not be able to recreate the signature for another