Rogue external MFA providers can steal passwords during Microsoft Entra logins

TrustSink Attack Overview

Security researchers at Varonis Threat Labs developed an attack named TrustSink. This technique allows an attacker who has already compromised a highly privileged Microsoft Entra account to register a malicious external Multi-Factor Authentication (MFA) provider. This rogue provider then intercepts and steals user passwords during what appears to be a normal login process.

How the Attack Works

Microsoft Entra supports external MFA providers, allowing organizations to integrate third-party authentication services. When a user logs in with a password, Entra can redirect them to an external MFA provider for the second factor. In the TrustSink attack, the malicious provider, once registered, presents a convincing fake Microsoft password prompt. This prompt captures the user's password in plaintext before the provider returns a valid signed token to Entra, completing the login without errors. The rogue provider remains active, capturing new passwords even after a password reset.

Prerequisites and Impact

TrustSink is not an initial-access attack; it requires an attacker to already control a highly privileged Entra account. The attack abuses the trust Microsoft places in configured external MFA providers. Varonis demonstrated this by creating a malicious provider that mimicked Microsoft's password page. During the proof-of-concept, the user initially entered credentials on Microsoft's legitimate site, but when MFA was triggered, Entra redirected to the attacker's provider, which then captured the password.