“The difference between MITM and MOTS is straightforward,” says Don Smith, senior director of the Counter Threat Unit at Secureworks. “With MITM, the attacker is present on infrastructure the traffic is traversing and can tamper with it,” he says. “We do not know how the fraudulent traffic was injected,” Smith says. “The only way to detect such activity would be to monitor the sequence of packets arriving in response to the request and looking for out of the sequence””]