A man-in-the-middle sits between two parties who believe they are communicating directly, relaying their traffic and, in the active version of the attack, rewriting it. Neither end sees anything unusual. A page loads, an ad server returns a creative, a measurement beacon fires, and all of it passes through a participant that neither party chose and neither party can observe.

The position exists because internet traffic crosses equipment nobody in the conversation controls. A request travelling from a handset to an ad exchange passes a home router, a mobile carrier or internet service provider, transit networks and usually a content delivery network before reaching its destination. Every one of those hops can read cleartext, and several can change it.

How the position is taken

MITRE catalogues the family under technique T1557, listed as Adversary-in-the-Middle. Its sub-techniques describe mechanism rather than motive: name resolution poisoning and relay, ARP cache poisoning, DHCP spoofing, and the evil twin, a rogue wireless access point impersonating a network the device has joined before, added on 17 September 2024. Route hijacking does the same at larger scale, pulling traffic for an address block through networks with no business carrying it.

Encryption changes what the position is worth. Transport Layer Security, the protocol behind HTTPS, authenticates the server with a certificate chaining to an authority the client already trusts, so an interceptor presenting its own certificate produces a browser warning. Defeating that requires either a trusted certificate the interceptor controls or a downgrade onto a weaker protocol before the handshake completes. Advertising kept walking into the first route. A root certificate placed in a device's trust store makes every forged certificate look legitimate, turning interception into a supported feature rather than something a browser can flag.

Where advertising encountered it

Three cases established the pattern.

Superfish VisualDiscovery, preinstalled by Lenovo on consumer laptops from around late 2014, injected shopping advertisements into pages. Because search engines had already moved to HTTPS, the software could not modify what it could not read, so it installed a self-signed root certificate and re-signed every site certificate with its own. US-CERT published an alert on 20 February 2015 describing the result as a classic man-in-the-middle position; the interception library, from a company called Komodia, was tracked as vulnerability note VU#529496. The same private key shipped on every affected machine, and once extracted it was usable by anyone. The Electronic Frontier Foundation reported observing 44,000 Superfish certificates through its SSL Observatory.

Carriers did the same at network level, with no software on the device. Verizon Wireless began inserting a unique identifier header into customers' cleartext requests from at least December 2012 to support its targeted advertising programmes, and did not disclose the practice for roughly two years. The Federal Communications Commission's Enforcement Bureau settled on 7 March 2016 for $1.35 million, with an obligation to obtain opt-in consent before sharing the identifier with third parties. Because insertion happened upstream of the handset, the identifier could not be deleted like a cookie.

Scale came from a Google and academic study presented at the IEEE Symposium on Security and Privacy in May 2015. The authors found ad injection evidence in 5.2% of client-side reports, affecting a daily average of 5.5% of unique addresses reaching Google. They identified 50,870 Chrome extensions and 34,407 Windows binaries capable of injection, of which 38% and 17% respectively were explicitly malicious. Roughly 5% of the resulting revenue chains ran through DoubleClick.

Origin and evolution

The formal model predates the commercial internet. Danny Dolev and Andrew Yao's 1983 paper on the security of public key protocols defined an attacker with complete control of the network, able to read, delete and forge messages, and that adversary remains the benchmark against which protocols are assessed. RFC 4949, the Internet Security Glossary published in August 2007, gave the term its reference definition.

Advertising's response was to encrypt the delivery chain. The Interactive Advertising Bureau issued a call to action on 25 March 2015, noting that a late-2014 survey found nearly 80% of member ad delivery systems already supporting HTTPS, and warning that a migrating publisher needed every tag on the page, direct or indirect, to support it too. Google followed on 17 April 2015, committing to encrypt the majority of display, video and mobile advertisements served to its network, AdMob and DoubleClick publishers by 30 June that year. Browsers closed the gap: Chrome began labelling all unencrypted pages as not secure with version 68 in July 2018, announced that February, after earlier stages had limited the warning to pages carrying password or payment fields.

Terminology moved too. The IETF prefers on-path attacker, on the grounds that the older phrase is imprecise as well as gendered, and separates it from an off-path attacker who can insert packets but not delete them. MITRE settled on adversary-in-the-middle. Monster-in-the-middle and machine-in-the-middle circulate. The original phrase is still the one most practitioners use.

Why it matters to the marketing community

Interception undermines the assumptions measurement rests on. An injected advertisement is indistinguishable from a legitimate one to the advertiser paying for it and to the person seeing it, so budget flows to inventory the publisher never sold. A modified beacon reports an event that did not happen. Consent signals face the same exposure, which is why the IAB Tech Lab finalised its Accountability Platform specification on 5 November 2024 to validate that preference strings survive the chain intact.

Supply chain standards approach the problem from a different angle. The SupplyChain object lets a buyer count the intermediaries that handled a bid request, and its buy-side counterpart, the DemandChain object, extends the same declaration to the demand side. Neither verifies anything cryptographically, and Brian O'Kelley has described the combined transparency files as partial signals spread across multiple layers. A declared chain is an honesty system, not a proof.

Interception also has sanctioned forms. Server-side ad insertion places a stitching proxy between player and ad server by design, which is why VAST 4.1 requires it to forward device headers rather than substitute its own. Corporate gateways decrypt outbound traffic to inspect it: Cloudflare's controls for agent protocols depend on that inspection on managed devices and see nothing on unmanaged ones. Researchers use the technique openly, as in an investigation into LG televisions that relied on packet capture plus an interception certificate installed on the set and recorded street-level location data going to LG's advertising arm over HDMI.

Limitations and disputes

Encryption has narrowed the classic attack close to the margins of the open web, and the residual risk has moved to the endpoints. A malvertising campaign documented in July 2026 assembles its payload inside the browser rather than shipping a finished file, defeating inspection on the wire whether or not anyone is listening. Compromise arriving with the hardware has the same effect, as with the pre-infected streaming devices behind large-scale connected television fraud.

The defence is also the obstacle. End-to-end encryption means, as Meta's own engineering account of Messenger link checking concedes, that content is protected from everyone in transit including the platform. Verification vendors lose the same visibility: traffic leaving a home through a proxy software development kit embedded in a television application is encrypted, and the intermediary is invisible to systems reading only the address.

Corporate interception is contested on principle: decrypting employee traffic is a deliberately engineered man-in-the-middle position, defended as necessary for threat detection and criticised for weakening the guarantee it inspects. Competitive intelligence has used the same machinery. Court documents unsealed on 26 March 2024 in a class action against Meta described a 2016 programme, run through the Onavo subsidiary, that installed kits on devices to read otherwise encrypted traffic from Snapchat and later YouTube and Amazon. An internal message quoted in the filings called it a man-in-the-middle approach. Meta has said the claims are without merit.

Not the same as

An on-path attacker is the IETF's preferred name for the active case described here. An off-path attacker can inject packets but not remove them, a weaker position often labelled man-on-the-side.

Ad injection is an outcome. It can follow interception, but a browser extension with page access achieves it without touching the network.

Prompt injection hides instructions in content an artificial intelligence system reads. Brave researchers demonstrated it against agentic browsers, showing hidden text triggering cross-site actions a user never requested. The channel is intact; the content is poisoned.

An intermediary in the programmatic supply chain is a disclosed, contracted participant. The distinction is consent and disclosure, not position.

Recent developments

Identity in transit is being rebuilt on signatures rather than network origin. Web Bot Auth has automated clients sign each request with a private key, and Cloudflare published a registry format for discovering those signing keys on 30 October 2025. GreyNoise reported on 28 August 2026 that scanners across 824 addresses forged the names of thirteen artificial intelligence crawlers, a reminder that a self-declared header proves nothing. Credentials moved the same way, with passkeys bound to a domain so relayed one-time codes stop working.

The transport layer is hardening against a different threat. Cloudflare's resolver began validating post-quantum DNSSEC signatures in September 2026, and its own measurements put post-quantum encryption at 52% of TLS 1.3 traffic at the end of 2025, against 13% a year earlier.

Agents complicate it again. British regulators warned on 1 April 2026 that autonomous systems granted broad permissions widen the attack surface. When software reads the network on someone's behalf, the question of who occupies the middle stops being rhetorical.

Timeline

  • 1983: Danny Dolev and Andrew Yao formalise an attacker with full control of the network in their paper on the security of public key protocols
  • August 2007: RFC 4949, the Internet Security Glossary version 2, publishes a reference definition of the term
  • December 2012: Verizon Wireless begins inserting unique identifier headers into customers' cleartext traffic
  • Late 2014: Lenovo ships consumer laptops preloaded with Superfish VisualDiscovery
  • 20 February 2015: US-CERT publishes an alert on Superfish and the Komodia interception library
  • 25 March 2015: The Interactive Advertising Bureau issues its call to action on HTTPS adoption in advertising
  • 17 April 2015: Google commits to encrypting the majority of display, video and mobile advertisements by 30 June 2015
  • May 2015: Research presented at the IEEE Symposium on Security and Privacy measures ad injection affecting 5.5% of unique daily addresses reaching Google
  • 7 March 2016: The FCC settles its investigation into Verizon's identifier headers for $1.35 million
  • July 2016: Facebook's Onavo team proposes device kits to read encrypted competitor traffic
  • 8 February 2018: Google announces that Chrome 68 will mark all unencrypted pages as not secure
  • July 2018: Chrome 68 ships with the warning enabled
  • 26 March 2024: Court filings describing the Onavo interception programme are unsealed
  • 17 September 2024: MITRE adds the evil twin sub-technique to T1557
  • 5 November 2024: IAB Tech Lab finalises the Accountability Platform specification for privacy signal integrity
  • 30 October 2025: Cloudflare publishes a registry format for discovering bot signing keys
  • 28 August 2026: GreyNoise reports scanners forging thirteen crawler identities from 824 addresses

Summary

Who. Network operators, carriers, device manufacturers, adware vendors, enterprise security gateways, researchers and criminals have all occupied the position. Standards bodies including the IETF, MITRE and the IAB Tech Lab define and constrain it.

What. A third party positioned between two communicating endpoints, relaying and potentially altering traffic neither side knows is being handled. MITRE indexes the family as T1557; the IETF calls the active case an on-path attacker.

When. Formalised in 1983, defined in RFC 4949 in 2007, and most visible in advertising between 2012 and 2016 through carrier header insertion, preinstalled interception adware and browser ad injection at scale.

Where. Anywhere traffic crosses infrastructure the endpoints do not control: local networks, wireless access points, carrier networks, routing between networks, resolvers, and the device itself when a certificate store has been altered.

Why. The position converts cleartext into a monetisable or intelligence-bearing asset. Encryption removed most of the commercial incentive on the open web, but the same technique persists where a trusted certificate can be installed, and identity in transit is now being rebuilt around signatures rather than assumptions about the path.