Definition
A Man-in-the-Middle attack is one where an adversary positions themselves between two communicating parties and impersonates each to the other. Each side believes it is talking to the genuine counterpart; in reality, both are talking to the attacker, who reads and may modify everything that passes through. MITM attacks are the active sibling of passive eavesdropping: the attacker is not just listening but participating.
How VPNs Defend Against It
The defence is server authentication. The VPN client verifies the server's certificate against a known Certificate Authority before sending any session-establishing material. An attacker who has not stolen the provider's CA private key cannot present a certificate the client will accept, and the connection fails closed. This is why proper certificate validation is non-negotiable: a VPN client that skips or weakens validation invites trivial MITM attacks on hostile networks.
Where MITM Still Threatens
Outside the VPN tunnel, MITM remains a concern. A captive portal at a hotel can intercept HTTPS by injecting its own root certificate; a corporate network may install a TLS-inspection proxy that does the same legitimately. On the public internet, MITM against properly configured HTTPS is rare but possible — historically through compromised CAs, BGP hijacks, and stolen private keys. End-to-end encryption (Signal, ProtonMail) provides the strongest protection because no intermediary holds keys to impersonate either side.