Rogue MFA Provider Can Siphon Passwords

A compromised privileged account is already a nightmare for any organization. Now researchers have shown it can be transformed into a persistent password harvester that hides inside the very login flow users are told to trust. Varonis Threat Labs calls the technique TrustSink, and it exploits the trust Microsoft Entra places in external multifactor authentication providers.

How external MFA providers work

Microsoft Entra allows organizations to use third-party authentication services to satisfy multifactor authentication requirements. According to Microsoft, when a user signs in with a first factor, such as a password, Entra can redirect them to an external MFA provider to complete the required second factor. If the provider returns a valid signed token indicating that the second factor was completed, Entra considers the MFA requirement satisfied.

This design makes it possible for businesses to integrate specialized or regional MFA vendors without forcing users to manage multiple credentials. But it also creates a dependency: Entra trusts that the external provider will actually perform the promised authentication check. That trust is exactly what TrustSink abuses.

Building a malicious provider

To pull off the attack, an adversary first needs a highly privileged Entra account. Varonis found that an attacker who has already compromised such an account can register a rogue External Authentication Method (EAM) as one of these external MFA providers. The malicious provider then inserts a convincing Microsoft password prompt into the legitimate authentication flow.

The fake prompt captures the user's password in plaintext before the malicious provider returns a valid signed token to Entra, causing the login to complete without displaying an error. In the proof-of-concept attack, the login initially proceeds normally: the user enters their email address and password on Microsoft's legitimate login.microsoftonline.com site. When MFA is triggered, Entra redirects the browser to the attacker's external MFA provider for the second authentication step. Instead of presenting a legitimate second-factor challenge, the malicious provider displays a copy of Microsoft's password prompt.

If the victim enters their password again, believing Microsoft is requesting it as part of the authentication process, the credential is sent to the attacker-controlled server. The rogue provider then generates a signed token stating the MFA prompt was completed and returns it to Entra, allowing the user to continue to the application they originally attempted to access. From the victim's perspective, the sign-in appears to have completed normally.

Why the fake prompt looks real

Varonis says the attack is convincing because the fake password prompt appears when the user already expects another authentication step. The researchers say the page uses the same fonts, layout, and button design as Microsoft's legitimate login page and appears immediately after the victim enters their real password on Microsoft's domain.

That timing is critical. Users have been trained to see a second prompt during MFA and may not question why a password is being requested again. The malicious page mimics Microsoft's visual identity closely enough that even cautious users might comply.

Persistent credential theft

Once installed, the rogue provider can remain in the authentication path for targeted users across subsequent logins. Because the rogue MFA provider remains registered in the tenant's Authentication Methods Policy, even if a user changes their password, it will be recaptured on the next log in attempt.

"In our test tenant, every sign-in completed normally while our server received passwords with timestamps and source IP addresses," explains Varonis.

"Resetting a captured password did not remove the rogue provider. It remained in the authentication flow and captured the replacement password at the user's next sign-in."

— Varonis Threat Labs

That persistence means a simple password reset is not enough to evict the attacker. Varonis therefore warns administrators to remove the malicious provider before rotating affected credentials.

What attackers need to get started

TrustSink is not an initial-access attack. It requires an attacker to already control a highly privileged Entra account. Specifically, Varonis says registering the malicious external method requires modifying the Authentication Methods Policy and creating an application, service principal, and consent grant. Those actions require a Global Administrator or Authentication Policy Administrator account, making TrustSink a post-compromise technique.

The barrier is high, but once an attacker has that level of access, the rogue provider can be installed quietly and begin harvesting credentials from targeted users without triggering obvious errors. The attack works with any provider that relies on this external authentication model, though the researchers demonstrated the attack using Microsoft Entra.

Building on prior research

Varonis says TrustSink builds on previous research by security researcher Dirk-Jan Mollema, presented at x33fcon 2025 in a talk titled "Bringing Your Own Identity in Entra ID." Mollema showed how a rogue registered external MFA provider could satisfy an MFA requirement by returning a signed JWT claiming authentication had succeeded without actually performing the expected authentication check. TrustSink abuses the same attack for credential theft.

The progression from bypassing MFA to stealing passwords during the MFA flow highlights how attackers refine techniques over time. What started as a way to skip a security control has been turned into a way to undermine the credentials that control is meant to protect.

Defending against TrustSink

Varonis recommends removing suspicious external MFA providers and their associated applications, keys, and redirect URIs before resetting affected users' passwords. Organizations should also monitor changes to the Authentication Methods Policy, limit standing Global Administrator and Authentication Policy Administrator privileges, and use phishing-resistant authentication methods such as FIDO2 or Windows Hello for Business.

The key takeaway is that password resets alone will not remove the threat. If a rogue provider remains registered, it will simply capture the new password. Administrators must first clean up the authentication configuration, then rotate credentials.

Practical steps for administrators

With TrustSink in mind, security teams should review their external MFA provider configuration and audit any recent changes to the Authentication Methods Policy. Look for unfamiliar applications, service principals, or consent grants that might indicate a rogue provider. Implementing least-privilege principles for administrative roles can reduce the likelihood that a compromised account can register a malicious provider in the first place.

Phishing-resistant authentication methods like FIDO2 security keys or Windows Hello for Business can also help, because they do not rely on a password prompt that can be spoofed. However, the external MFA provider mechanism itself remains a potential weak point if an attacker already has the necessary administrative access.

What this means for the industry

The TrustSink technique is a reminder that security controls can become attack surfaces when trust is misplaced. External MFA providers are designed to strengthen authentication, but if an attacker can register a rogue provider, that same mechanism can be used to steal credentials. For organizations using Entra, the attack underscores the importance of monitoring administrative actions and limiting standing privileges. It also suggests that password-based authentication remains a liability, even when wrapped in MFA. As long as users can be tricked into entering their password into a convincing fake prompt, attackers will find ways to exploit that moment of trust.