A SOC analyst reviews traffic captures from a corporate wireless network. A client attempted to reach an internal HTTPS portal, but the packet capture shows the connection was negotiated down to an unencrypted HTTP session by an intermediate device that also relayed the traffic to the real server. Users noticed nothing unusual, and the attacker's system logged the plaintext credentials. Which type of network attack does this MOST clearly describe?