The login process for online mode servers & clients:

C→S: Handshake with Next State set to 2 (login)
C→S: Login Start
S→C: Encryption Request
Client auth
C→S: Encryption Response
Server auth, both enable encryption
S→C: Set Compression (optional)
S→C: Login Success

The login process for offline servers & any client:

C→S: Handshake with Next State set to 2 (login)
C→S: Login Start
S→C: Login Success
(Skipping the whole auth)

Notice how Encryption request is not sent to the client. An online mode and offline mode client will both act the same way here, and simply assume authentication isn't required (which it isn't). No auth packets are sent from online mode clients.

So what you need to do is listen for the Client > Server Login start packet, and insert your own Encryption Request packet, then give the client a second or so to send packet an Encryption Response packet. The difficulty is getting the data for the Encryption Request packet.