Network devices compromised for adversary-in-the-middle attacks