Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Adversary-in-the-middle (AiTM) phishing uses a live relay between you and Google. The attacker shows a convincing sign-in page, forwards what you enter to the real Google service, relays one-time codes or approval prompts, and may steal the authenticated browser session after you finish signing in. A familiar-looking page is therefore not proof that a login is safe.
Stop when the address, redirect, request, or message is unexpected; use a known Workspace bookmark or a trusted address entered manually; and prefer passkeys or FIDO2 security keys. If you suspect compromise, preserve the message and URL, review account activity, and have an administrator revoke sessions and unauthorized factors before resetting credentials.
What an adversary-in-the-middle attack does
In an ordinary credential-phishing attack, the criminal hopes you type a password into a fake site. AiTM phishing is more capable: the criminal-controlled relay sits between your browser and the legitimate Google identity service. It can display a look-alike login flow while forwarding your username, password, and subsequent authentication steps to Google in real time.
When Google accepts the sign-in, the relay can target the authenticated browser session, including the session cookie that keeps you signed in. The attacker may then use that stolen session to access Workspace without needing to repeat the password or second-factor prompt. Google’s Workspace security guidance describes stolen authentication cookies as an account-takeover threat and recommends both phishing-resistant authentication and session protections.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
AiTM is not the same as a simple fake form that merely collects a password. A page can relay a time-based code, push approval, or other second-factor interaction and still leave the attacker with a valid session. That is why approving an unexpected prompt or entering a one-time code into an unexpected page is dangerous even when 2-Step Verification is enabled.
Why the risk matters
- Google reported that phishing and credential theft drove 37% of successful intrusions in its 2025 Google Workspace Blog reporting. That figure covers phishing and credential theft broadly, not AiTM attacks alone.
- The same 2025 reporting described an 84% increase in email-delivered infostealers during 2024. Infostealers and phishing can work together: malware can steal browser data while a relay captures a fresh login.
- Google said passkey support was generally available to more than 11 million Workspace customers in that 2025 announcement. The customer count is not a measure of AiTM prevalence.
How to recognize a suspicious Google Workspace login
Use several signals together. A polished page, a Google logo, or a lock icon does not establish that you are communicating directly with Google.
Check the address before entering anything
- Pause before typing a password, code, or approving a prompt.
- Read the full address bar, including the domain and any unusual path. An unfamiliar domain, look-alike spelling, URL shortener, or unexpected redirect is a stop signal.
- Reach sign-in through your organization’s known Workspace bookmark or by manually entering an address that your administrator has documented. Do not rely on a link in an unexpected message.
- If a page changes domains during sign-in, close it and verify the request through a separate channel such as a known phone number or an existing internal chat.
A domain that contains a familiar word is not necessarily Google. Attackers commonly place a legitimate-looking name in a subdomain, path, or page title while the registrable domain belongs to someone else.
Treat urgency as an untrusted signal
Messages claiming that a shared file will be deleted, a password will expire, an invoice needs approval, an HR document is waiting, or a security alert requires immediate action should be verified independently. Do not use the reply address or telephone number in the message for that verification. Open the organization’s normal application or contact a colleague using details you already trust.
Notice unusual prompts after the password
- Never type a one-time code into a page reached from an unexpected message.
- Do not approve a push notification you did not initiate. Deny it and report the event.
- Stop if the page asks for an unusual consent screen, recovery-factor change, or passkey action.
- Contact your administrator if a sign-in flow requests a recovery code, new phone number, or security-key registration without a planned enrollment.
Remember that a normal-looking sign-in can still be relayed
AiTM pages can copy Google’s visual design and forward each step quickly enough to feel normal. The decisive checks are the destination, the way you reached it, and whether you initiated the action—not the page’s appearance.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Are passkeys and security keys safe from AiTM phishing?
Passkeys and FIDO2 security keys provide phishing-resistant authentication because the credential is bound to the legitimate website or app identity. Google states: “Because passkeys are bound to a website or app’s identity, they’re resistant to phishing attacks.” A relay at a different origin cannot normally obtain a credential response valid for Google.
Google also explains that, unlike passwords, passkeys cannot be shared, copied, written down, or accidentally given to someone else. Supported passkey devices include FIDO2 hardware security keys. A Titan Security Key is an example of that hardware class; the important property is the FIDO2 protocol and origin binding, not the product name.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Phishing resistance does not make a compromised device harmless. Malware, a malicious browser extension, an attacker with control of the operating system, or an already-stolen active session can still threaten an account. Keep devices and browsers updated, use a separate security key for high-value accounts when appropriate, and maintain a recovery plan before enforcing a new factor.
What to do immediately after a suspicious sign-in
Act from a device and network you trust. If you are unsure whether the current browser is compromised, use a separate managed device or ask your administrator to take the first containment action.
- Stop interacting with the page. Close the tab. Do not enter another code, approve another prompt, or install software it requests.
- Preserve evidence. Keep the original message, complete headers, sender details, destination URL, timestamps, and screenshots if policy permits. Do not forward a live phishing link to colleagues; send it through your organization’s reporting process.
- Report the message. Use the organization’s phishing-reporting mechanism and tell the help desk that an AiTM relay is possible, not merely a fake-password page.
- Review account activity. From a trusted session, inspect recent devices, security activity, newly added passkeys or security keys, recovery changes, OAuth grants, forwarding rules, and unfamiliar sessions.
- Ask an administrator to contain the account. The administrator should revoke active sessions and tokens, remove unauthorized factors and recovery methods, and investigate suspicious OAuth access or mail forwarding.
- Reset credentials after containment. Change the password only after sessions and unauthorized factors have been dealt with. Otherwise, a stolen session or newly added factor may continue to provide access.
- Assess exposed data. Review Drive activity, Gmail access, shared files, administrative actions, and other systems that trust the Workspace identity. Follow your organization’s incident-notification requirements.
Changing a password alone is not a complete response to a stolen-cookie attack. The objective is to invalidate the attacker’s existing access and remove persistence, then investigate what the session accessed.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Controls Workspace administrators should deploy
1. Roll out phishing-resistant sign-in
Prioritize super administrators, help-desk personnel, finance teams, executives, and other accounts whose compromise would provide broad access or enable fraud. Offer passkeys or FIDO2 security keys and document how users enroll, replace a lost device, and recover an account.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Google’s early 2023 Workspace data reported that passkeys were twice as fast and four times less error-prone than passwords. Those figures describe Google’s early data, not a guarantee for every organization or device.
2. Set a clear passkey and 2-Step Verification policy
Decide whether users may skip passwords when signing in with a passkey and communicate the choice before enrollment. Enrolling a passkey does not automatically enable 2-Step Verification, according to Google’s Workspace guidance. Administrators must configure the intended policy and explain which accounts require an additional factor.
Test the policy with a pilot group, including account recovery and device replacement. Do not remove a user’s only working recovery method until another verified method is available.
3. Use Advanced Protection for the highest-risk users
Google’s Advanced Protection guidance supports security keys and passkeys as 2-Step Verification methods. It also enables enhanced pre-delivery scanning of incoming email. Apply it where the additional enrollment and recovery requirements fit the user’s role and risk profile, especially for administrators and people targeted by highly convincing spear-phishing.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
4. Add post-login session protection with DBSC
Device Bound Session Credentials (DBSC) bind a session cookie to the device that authenticated. Google announced general availability in Chrome on Windows on May 28, 2026, with DBSC enabled by default for Google Workspace users. This reduces the usefulness of a copied cookie because the attacker may not possess the device-bound key needed to use it.
DBSC complements, rather than replaces, phishing-resistant sign-in and incident response. Its documented Workspace availability is specific to Chrome on Windows; verify current browser, operating-system, and administrative support before assuming equivalent coverage elsewhere. A compromised device or active session still requires investigation and revocation.
5. Monitor the events an AiTM attack leaves behind
Use Workspace security investigation tools and audit data to look for:
- Sign-ins from unusual locations, devices, or session patterns.
- New passkey or security-key enrollment.
- Changes to recovery email addresses, phone numbers, or other factors.
- New OAuth grants, especially for unfamiliar applications.
- Mail-forwarding rules, filters, delegates, or changes to sharing permissions.
- Administrative actions performed soon after a suspicious login.
Build an escalation path that tells analysts which events trigger immediate session revocation and which require broader data review. Preserve relevant logs according to your retention and legal requirements.
Free tools Windows power users keep installed
One-click scans. No signup required.
Comparing authentication and session options
| Option | Resistance to AiTM credential capture | Protection after login | Administration and recovery | Compatibility, effort, and cost |
|---|---|---|---|---|
| Passkeys | Strong. Origin-bound public-key credentials are designed to resist relay-based credential capture. | They do not by themselves protect an already-stolen session cookie. | Admins must decide password-skipping and 2-Step Verification policy, then provide enrollment and recovery procedures. | Requires a supported device and browser. Google’s cited materials do not state a universal price; rollout effort depends on devices, training, and recovery support. |
| FIDO2 hardware security keys | Strong. The physical key performs phishing-resistant authentication for the legitimate origin. | They do not invalidate a session that was stolen through another route. | Useful as a separate factor for administrators and high-risk users. Plan spare keys, secure storage, and lost-key replacement. | Requires compatible hardware and USB, NFC, or other supported connection. Product and procurement costs are not stated in the cited Google materials. |
| Password plus OTP or push MFA | Better than a password alone, but an AiTM relay can forward codes or socially engineer an approval. | Does not inherently bind the session to the authenticating device. | Familiar to users and widely deployable, but requires stronger monitoring and prompt-reporting procedures. | Compatibility is broad. The cited materials do not state a single cost or rollout effort. |
| DBSC session binding | Not an initial sign-in method; it addresses stolen post-login cookies. | Strengthens the session by binding the cookie to the authenticating device. | Use alongside phishing-resistant authentication and normal revocation and investigation processes. | Google documented general availability in Chrome on Windows on May 28, 2026, enabled by default for Workspace users. Coverage for other browser and operating-system combinations must be verified. |
A practical rollout sequence
- Inventory risk. Identify super administrators, support staff, financial approvers, executives, service owners, and users with access to sensitive data.
- Define policy. Decide which accounts require passkeys or security keys, whether passwords may be skipped, what 2-Step Verification means for each group, and how recovery is handled.
- Pilot safely. Enroll a small group, test Windows and non-Windows browsers used by the organization, and verify that users can replace a lost device without bypassing controls.
- Train on relay indicators. Demonstrate address-bar checks, independent verification, unexpected prompts, and the correct reporting route. Make clear that a second-factor prompt is not automatically trustworthy.
- Expand by risk. Move high-value accounts first, then broader groups as support and recovery procedures prove reliable.
- Enable session defenses. Confirm DBSC coverage where Chrome on Windows is supported and retain procedures for revoking sessions and tokens.
- Exercise response. Run a tabletop scenario involving a stolen cookie, unauthorized passkey enrollment, OAuth access, and mail forwarding. Confirm that investigators can contain the account and identify affected data.
Common mistakes and their fixes
“The page has a lock icon, so it is safe.”
HTTPS encrypts the connection to the site you reached; it does not prove that the site is Google. Read the domain and the route that brought you there.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
“I used 2-Step Verification, so AiTM cannot work.”
A relay can forward a one-time code or push approval and then target the resulting session. Use a passkey or FIDO2 key wherever practical, and reject prompts you did not initiate.
“I changed my password, so the incident is over.”
A stolen session, newly enrolled factor, OAuth grant, or forwarding rule can survive a password change. Revoke sessions and tokens, remove unauthorized persistence, and review audit data first.
“Passkeys eliminate every account risk.”
Passkeys protect the authentication exchange against ordinary origin-confusion phishing. They do not neutralize malware, malicious extensions, a compromised operating system, or an already-compromised session.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute“Everyone can enroll without a recovery plan.”
Require a tested replacement and recovery process. A lost device, unavailable security key, or locked-out administrator can otherwise force an unsafe emergency bypass.
What administrators should record during an investigation
- The first suspicious message, its complete headers, and every destination URL.
- When the user entered credentials, codes, or approvals and from which device.
- Recent sign-ins, session locations, browser and device details, and token activity.
- New passkeys, security keys, recovery methods, OAuth grants, delegates, filters, and forwarding rules.
- Files viewed, downloaded, shared, or modified during the suspected session.
- Containment actions, including session revocation, factor removal, credential reset, and notifications.
These records help distinguish a blocked phishing attempt from a successful session-theft incident and support any required internal, legal, or customer notification.
The bottom line for Workspace users
Assume an unexpected Google sign-in page may be a relay until its destination and context are verified. Use known entry points, never surrender codes or approve prompts you did not initiate, and report unusual consent or recovery requests. Passkeys and FIDO2 security keys provide the strongest defense against AiTM credential capture; DBSC adds protection against use of stolen cookies where supported. After a suspicious event, revoke sessions and unauthorized factors, then reset credentials and investigate the account’s data and configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
