525/69 Thursday, September 24, 2026
Researchers from Varonis Threat Labs have disclosed an attack technique named TrustSink that allows attackers with elevated privileges in an Identity Provider environment to register a rogue external MFA provider and use it to steal users’ passwords during an apparently legitimate login process. The technique may apply to identity providers that support similar external authentication models, although the researchers demonstrated it using Microsoft Entra. Microsoft Entra supports External MFA Providers, allowing organizations to use third-party authentication services to satisfy multifactor authentication (MFA) requirements.
Under normal circumstances, after a user signs in with a first authentication factor such as a password, Entra can redirect the user to an External MFA Provider to complete the second authentication step. If the provider returns a valid signed token indicating that MFA has been successfully completed, Entra considers the MFA requirement satisfied. However, Varonis found that if an attacker compromises a highly privileged Entra account, such as a Global Administrator or Authentication Policy Administrator, they can create a rogue External Authentication Method (EAM) and insert a fake password prompt that impersonates Microsoft into the login flow. When the victim re-enters their password believing it is part of the normal authentication process, the credential is sent to the attacker’s server. The rogue MFA provider then returns a token to Entra, allowing the login process to continue normally without displaying an error.
Varonis stated that TrustSink is not an initial access technique, but rather a post-compromise technique used after an attacker has already obtained high-level privileges within a tenant. A key risk is that the rogue MFA provider can remain configured in the Authentication Methods Policy even after users change their passwords, allowing newly changed passwords to be captured again during subsequent logins. Organizations should therefore identify and remove suspicious External MFA Providers, as well as related applications, keys, and redirect URIs, before resetting passwords for affected users. Administrators should also monitor changes to Authentication Methods Policy, minimize standing privileges for Global Administrator and Authentication Policy Administrator accounts, and consider using more phishing-resistant authentication methods such as FIDO2 or Windows Hello for Business.