Researchers Uncover TrustSink Attack Using Rogue MFA Providers to Steal Passwords

Researchers at Varonis Threat Labs have identified a new attack technique, dubbed TrustSink, that allows attackers to steal plaintext passwords by registering rogue external multi-factor authentication (MFA) providers.

The attack targets organisations using Microsoft Entra ID that utilise external authentication models to satisfy MFA requirements. By compromising a highly privileged account, an attacker can insert a malicious provider into the legitimate authentication flow.

How the TrustSink attack works

The process begins when a user attempts a legitimate login to a Microsoft service. After entering their email and password on the official Microsoft domain, Entra triggers an MFA request and redirects the user’s browser to the configured external provider.

Under the TrustSink method, the rogue provider presents a fake Microsoft password prompt instead of a standard MFA challenge. Because the prompt appears immediately after the initial login step, it appears legitimate to the user. If the victim enters their password into this fake prompt, the credentials are sent to the attacker’s server.

To ensure the user does not suspect foul play, the rogue provider generates a valid signed token and returns it to Entra. This allows the login to complete normally, leaving the user unaware that their password has been intercepted.

The research builds on earlier findings by security researcher Dirk-Jan Mollema regarding the ability to satisfy MFA requirements by returning signed JSON Web Tokens (JWT) that claim authentication has succeeded without performing actual checks.

Persistence and mitigation

TrustSink is a post-compromise technique, meaning it requires the attacker to already possess Global Administrator or Authentication Policy Administrator privileges to register the malicious External Authentication Method (EAM).

Crucially, the attack remains effective even after a user changes their password. Because the rogue provider remains registered within the tenant’s Authentication Methods Policy, it will simply capture the new password during the user’s next login attempt.

To remediate the threat, administrators should identify and remove suspicious external MFA providers, associated applications, keys, and redirect URIs before attempting to rotate affected user credentials. Security experts also recommend monitoring changes to Authentication Methods Policies and adopting phishing-resistant authentication methods, such as FIDO2 or Windows Hello for Business, to mitigate the risk of credential interception.