Rogue external MFA providers can steal passwords during logins
Varonis 'TrustSink' shows attackers with privileged Entra access can register rogue external MFA providers to harvest plaintext passwords during logins.
Varonis Threat Labs demonstrated TrustSink, an attack in which an attacker controlling a Global Administrator or Authentication Policy Administrator Microsoft Entra account registers a rogue External Authentication Method (EAM). The rogue provider displays a pixel-perfect copy of Microsoft's password prompt during the MFA step, capturing plaintext passwords, timestamps, and source IPs while sign-ins complete normally. Password resets are re-captured at the next login, so the rogue provider must be removed before credential rotation. The work builds on Dirk-Jan Mollema's x33fcon 2025 'Bringing Your Own Identity in Entra ID' research, and Varonis recommends phishing-resistant methods like FIDO2 or Windows Hello for Business.
- Post-compromise technique requiring Global Admin or Authentication Policy Administrator access
- Rogue external MFA provider injects fake Microsoft password prompt into legitimate Entra logins
- Captured passwords re-stolen after resets; remove rogue provider before rotating credentials
- Mitigations: monitor Authentication Methods Policy, limit admin standing privileges, use FIDO2
- ATT&CK
- T1078 Valid AccountsT1098 Account ManipulationT1556 Modify Authentication ProcessT1056.003 Web Portal Capture
- Tags
- microsoft-entramfacredential-theftexternal-authentication-methodvaronisidentitypassword-harvesting
From the original article
3 min read at bleepingcomputer.com
Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users' passwords during legitimate login attempts. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.