Microsoft Defender XDR can automatically disrupt supported adversary-in-the-middle (AiTM) attacks that are already in progress, but it is not a guarantee that every phishing attempt will be stopped before a password or session token is exposed. The protection coordinates actions across supported identity and endpoint workloads to contain compromised assets while security teams investigate.
What does “blocks AiTM attacks” mean?
Microsoft added AiTM to Defender XDR’s automatic attack disruption capability and announced general availability on July 4, 2023. In this context, “block” means detecting activity associated with a supported multi-stage attack and applying coordinated controls to disrupt it—not preventing every user from reaching a phishing page or ensuring that credentials and tokens are never captured. Microsoft describes the feature as a way to contain a compromised asset and limit further attacker movement while defenders respond. See Microsoft’s Attack Disruption documentation and its July 4, 2023 availability announcement.
In September 2026, Microsoft said its internal research showed that Defender disrupted more than 45,000 AiTM attacks per month. This is a Microsoft-reported figure, not an independently audited success rate, and it does not establish how often all AiTM attempts are prevented or disrupted across all tenants. The same Microsoft post reported more than 81,000 compromised user accounts contained monthly across attacks more broadly; that figure is not AiTM-specific. Microsoft Security Blog, September 10, 2026.
How does AiTM phishing bypass MFA?
An AiTM attacker places a reverse proxy between a victim and the legitimate sign-in service. The proxy relays the sign-in in real time. If the user successfully authenticates—including with many forms of multifactor authentication—the attacker may capture the resulting session token and use that authenticated session to access the account. This is why MFA that is not phishing-resistant can be bypassed: the attacker is relaying the authentication and stealing the session, rather than simply replaying a password.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Microsoft’s 2026 campaign report describes this token-based flow and details a campaign targeting more than 35,000 users at over 13,000 organizations in 26 countries between April 14 and 16, 2026. Those numbers describe that specific campaign, not the overall prevalence of AiTM phishing. Microsoft Defender Research, May 6, 2026.
What does Defender XDR do during an attack?
Attack disruption correlates signals across security domains and can take automatic action to contain an affected identity or endpoint. The aim is to interrupt an attacker’s progress, including further access or lateral movement, while the security team investigates and remediates. Microsoft Learn states that “Adversary-in-the-middle (AiTM) is a covered scenario in Microsoft Defender XDR Attack disruption, which provides coordinated threat defense early in the kill chain of an attack.” The guidance appears in Microsoft Learn’s Protecting Tokens in Microsoft Entra ID.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Because containment is a response capability, it should be paired with controls that reduce the chance of successful phishing, token theft, and session replay. It does not make the initial sign-in flow invulnerable, nor does the available Microsoft material establish a universal success rate for every tenant or AiTM technique.
What do you need to enable Defender attack disruption?
Coverage depends on the workloads deployed and the documented prerequisites and configuration in the tenant. Microsoft’s guidance calls for Defender XDR workloads including Defender for Identity, Defender for Office, and Defender for Cloud Apps. Its earlier announcement also described Defender for Cloud Apps connectivity together with deployment of Defender for Endpoint and Defender for Identity. Check the current prerequisites and configuration in the Attack Disruption documentation before relying on the capability.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
For device-hardening and token-protection scenarios, Microsoft also points to Defender for Endpoint and Intune, compliant-device Conditional Access, and monitoring for stolen-token or anomalous-sign-in signals. These requirements and recommendations vary by scenario. The cited guidance does not establish a complete, current SKU-by-SKU licensing matrix for every tenant, so confirm licensing for your specific deployment rather than assuming a universal license requirement.
How to protect Microsoft 365 session tokens
Use controls at multiple stages of the attack chain. A single setting cannot make AiTM impossible, and the right combination depends on your identity, device, and email configuration.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
| Control | Stage addressed | How it helps |
|---|---|---|
| Phishing-resistant authentication, such as supported FIDO keys or Windows Hello | Authentication | Reduces exposure to credential-relay phishing compared with methods that can be relayed through an attacker’s proxy. |
| Conditional Access requiring a compliant device | Sign-in and device access | Restricts access based on device compliance; Microsoft recommends combining this with device hardening. |
| Defender for Endpoint and Intune device hardening | Endpoint and token theft | Helps protect managed devices and supports device-based controls. |
| Safe Links, Safe Attachments, and Zero-hour Auto Purge | Email delivery and remediation | Microsoft recommends these email protections as part of a layered defense against phishing campaigns. |
| SmartScreen-supported browsers and controls for risky web destinations | Web delivery | Help reduce exposure to malicious destinations. |
| Restrict device-code authentication where it is not needed; manage high-risk users | Authentication and identity response | Reduces avoidable authentication exposure and supports response to risky accounts. |
| Defender XDR automatic attack disruption | Post-compromise detection and containment | Coordinates response to supported attacks so compromised assets can be contained while defenders investigate. |
Also monitor for suspicious sign-ins and indicators of stolen tokens, maintain endpoint protection, and train users to recognize phishing. Microsoft’s recommendations are described in its token-protection guidance and its 2026 AiTM campaign report.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When should an organization rely on attack disruption?
Treat it as an additional detection-and-containment layer, not a substitute for phishing-resistant sign-in, device controls, email and web protections, or an incident-response process. The feature is most useful when the relevant Defender workloads are deployed and configured, and the organization can act on the alerts and containment outcomes. If there is evidence a session token was stolen, investigate the identity and affected device, respond to the risky account and session, and review sign-in activity rather than assuming that an automatic disruption means no access occurred.
Recommended Free Tools
Quick Recap
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
