TrustSink Attack Uses Rogue MFA Provider to Steal Microsoft Entra Passwords During Legitimate Logins
Varonis disclosed TrustSink, a post-compromise Entra technique that steals passwords via a rogue MFA provider.
2
Tag
#external-authentication-method
0 stories this week · 0 this month · 2 in 6 months · mostly security
Stories per day · 30 days
2 stories, newest first · one card per story
Stories tagged #external-authentication-method
Rogue external MFA providers can steal passwords during logins
Varonis 'TrustSink' shows attackers with privileged Entra access can register rogue external MFA providers to harvest plaintext passwords during logins.
1