Adversary-in-the-middle (AiTM) phishing has become the single most common way attackers break into law firms, overtaking conventional credential theft in a sector where multifactor authentication (MFA) is now widely deployed but routinely bypassed.
According to a new legal sector threat intelligence report from eSentire shared with Infosecurity, AiTM attacks accounted for 28.57% of all initial access events in the legal sector.
The company's Threat Response Unit (TRU) also recorded a 20% year-over-year (YoY) increase in incidents targeting legal organizations.
Credential and identity-focused activity made up 56.3% of all threats to the sector, split between account compromise at 45% and direct credential phishing at 11%. eSentire framed this as a decisive move away from technical exploitation, with legal professionals rather than legal infrastructure now the primary attack surface.
MFA Deployed, MFA Bypassed
AiTM attacks proxy the authentication process, so a user who enters credentials correctly and completes an MFA challenge still hands the attacker a valid session cookie.
eSentire read the sector's comparatively low rate of conventional credential theft, 16.96% against a cross-industry average of 26.01%, as evidence that MFA has been widely adopted at law firms and that attackers have adapted around it rather than abandoning the target.
A single phishing-as-a-service platform, Tycoon2FA, drove 52.3% of AiTM-related account compromises in the legal sector across 2025. That platform was disrupted in March 2026 by a Microsoft and Europol-led operation in which eSentire was a partner, though activity quickly returned to early 2026 levels.
Read more on AiTM phishing: Tycoon2FA Phishing Service Resumes Activity Post-Takedown
Deadline Pressure as an Attack Surface
ClickFix attacks reached 13.39% of legal incidents against an 8.77% cross-industry average. The lures present fake browser errors claiming a document viewer, e-filing system or court portal needs immediate attention.
eSentire characterized this as workflow exploitation rather than a technical one, targeting the instinct to clear a blocking error before a filing deadline. The technique primarily delivered NetSupportManager RAT, which alone accounted for 26.2% of all malware detections in the sector.
Microsoft Teams abuse reached 6.25% of initial access, close to double the 3.40% cross-industry figure. Infostealers made up 30.4% of malware observed, led by Lumma Stealer at 9.6%.
The sector recorded an 86% overall intrusion ratio, meaning that in 86% of observed incidents the attack progressed beyond initial access into active intrusion. Ransomware intrusion sat at 23%, which eSentire read as attackers favoring quiet data and account access over operational disruption.
eSentire urged firms to deploy phishing-resistant MFA such as FIDO2 keys and passkeys, adopt conditional access policies that evaluate device health and location and monitor identity platform logs for anomalous session activity. It noted that only 34% of law firms hold a formal incident response plan, citing American Bar Association figures.