A Rogue External MFA Provider Can Steal Passwords During Legitimate Logins
Security researchers have developed an attack that allows hackers with privileged access to steal passwords from users during legitimate login attempts. The technique, dubbed TrustSink by Varonis Threat Labs, works by registering a rogue external Multi-Factor Authentication (MFA) provider as a trusted third-party authentication service.
Microsoft Entra is one of the MFA providers affected by this attack. When a user signs in with their password, Entra can redirect them to an external MFA provider for additional verification. If the provider returns a valid signed token indicating that the second factor was completed, Entra considers the MFA requirement satisfied and allows the user to access the application.
However, if an attacker has already compromised a highly privileged Entra account, they can register a rogue External Authentication Method (EAM) as one of these external MFA providers. The malicious provider then inserts a convincing Microsoft password prompt into the legitimate authentication flow, allowing it to capture the user’s password in plaintext before returning a valid signed token to Entra.
What makes this attack particularly concerning is that it appears to work seamlessly from the victim’s perspective. The fake password prompt looks identical to the real one and appears immediately after the user enters their password on Microsoft’s domain. As a result, users may not even realize they are entering their credentials into an attacker-controlled server.
Varonis researchers tested TrustSink using Microsoft Entra and found that it can work with any external MFA provider that relies on this authentication model. The attack requires an attacker to already control a highly privileged account in the target organization’s tenant, making it a post-compromise technique.
The key takeaway from this research is that organizations need to be aware of the potential risks associated with using external MFA providers and take steps to mitigate them. By regularly reviewing and updating their Authentication Methods Policy, administrators can help prevent rogue external MFA providers from being registered in the first place.
Moreover, users should exercise caution when entering their credentials into any application or website that may be redirecting them for additional verification. Verifying the authenticity of the second-factor challenge is crucial to preventing attacks like TrustSink.
As the cybersecurity landscape continues to evolve, it’s essential for both organizations and individuals to stay vigilant about potential vulnerabilities in authentication systems. By staying informed and taking proactive measures, we can reduce the risk of falling victim to sophisticated attacks like TrustSink.
Source: Bleeping Computer — 2026-09-22