Security researchers at Varonis Threat Labs have described a post-compromise technique that could allow attackers to capture passwords by registering a malicious external multi-factor authentication provider in a Microsoft Entra tenant.
The method, called TrustSink, targets Entra environments configured to use External Authentication Methods, which let organizations rely on third-party services for MFA verification. In the normal process, Entra redirects a user to the external provider after the initial sign-in step, then accepts a signed response indicating that the required second factor was completed.
According to the researchers, an attacker with sufficiently privileged access could configure a rogue provider that impersonates a legitimate MFA service. After a user enters credentials on Microsoft's genuine sign-in page, the login flow redirects them to the attacker-controlled provider. Rather than presenting an MFA challenge, the service displays a convincing additional password prompt.
If the user submits a password to that page, the malicious service can collect it and then return a valid signed assertion to Entra. The sign-in can therefore continue normally, potentially leaving the victim unaware that their credentials were exposed.
Privileged access required
TrustSink is not described as an initial-access technique. An attacker would first need control of an account with permissions such as Global Administrator or Authentication Policy Administrator. Setting up the attack requires changes to the Authentication Methods Policy and the creation of related application, service principal, and consent configurations.
The researchers said the risk may persist after a password reset if the rogue provider remains enabled. In that scenario, a user could enter their replacement password during a later login, allowing it to be captured as well.
Defensive measures
- Review External Authentication Methods and investigate unfamiliar MFA providers.
- Monitor changes to authentication policies, enterprise applications, consent grants, signing keys, and redirect URLs.
- Remove malicious provider configurations and associated application artifacts before resetting affected passwords.
- Restrict standing administrative privileges and apply least-privilege controls for identity management roles.
- Adopt phishing-resistant authentication options, including FIDO2 security keys and Windows Hello for Business, where appropriate.
The research builds on earlier work showing that a registered external provider could return assertions that satisfy MFA requirements without performing the expected verification. TrustSink extends that concept by using the trusted authentication redirection step to request and collect user passwords.