MITM attacks in their original form are mainly used for intercepting / sniffing traffic. So this could probably lead to a compromised administrative account on your local machine or your network, and this could lead to a lot of interesting behaviours of course. But you need to have some major "open doors" on your network for a MITM within your network to be successful. It's more likely that a single workstation infected with some kind of (keylogging) malware is the source of such a threat.

Anyways, it's hard to assess wether it's a real incident or just some kind of new gpo being rolled out without any further details ;-)

Regards.