AiTM attacks don't steal passwords; they copy the result of a real login. You need to watch what happens after the user logs ...