AiTM attacks don't steal passwords; they copy the result of a real login. You need to watch what happens after the user logs in to catch a hijacked session.
­Microsoft's Windows Hello for Business (WHfB) default phishing-resistant authentication model recently was found susceptible to downgrade attacks, allowing threat actors to crack into even ...