I'm surprised that most of the MitB attacks are still just stealing credentials instead of changing transaction contents on the fly.