Security1 publisher2 min readPublished
A rogue external MFA provider plants a fake Microsoft password prompt in Entra's login flow
Varonis Threat Labs' TrustSink needs an already-compromised Global Administrator or Authentication Policy Administrator account. Once the method is registered in the Authentication Methods Policy, it keeps capturing passwords through resets.
The Watch · Security desk
What happened
- Varonis Threat Labs published TrustSink, a technique in which an attacker holding privileged access registers a rogue external MFA provider that steals users' passwords during legitimate logins.
- When Entra triggers MFA and redirects the browser to the external provider, the rogue provider shows a copy of Microsoft's password prompt and captures what the user types in plaintext.
- The provider then returns a signed token to Entra saying the MFA prompt was completed, and the user continues into the application they wanted without seeing an error.
- Varonis says the registration needs a Global Administrator or Authentication Policy Administrator account, which makes TrustSink post-compromise and not a route to initial access.
- Varonis reports that resetting a captured password did not remove the rogue provider, which stayed in the flow and captured the replacement password at the user's next sign-in.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Response sequencing changes: the registration comes out of the policy before any credential rotation, because a tenant-wide reset run first hands the attacker every new password as users sign back in.
- exposure Any identity platform that accepts a third party's signed assertion as proof that MFA happened is reachable the same way; Entra was the demonstration target, not the boundary of the problem.
- constraint User-side detection is largely foreclosed, since the prompt copies the real page's fonts, layout and buttons and arrives seconds after the victim typed a password on login.microsoftonline.com.
Microsoft documents the exchange plainly. A user supplies a first factor such as a password, Entra redirects to the external MFA provider for the second, and a valid signed token from that provider satisfies the requirement [3]. Entra validates the token; the challenge the provider actually displayed is outside that check [4].
Varonis ran the technique in a tenant of its own. "In our test tenant, every sign-in completed normally while our server received passwords with timestamps and source IP addresses," Varonis said [7]. Once installed, the provider can stay in the authentication path for targeted users across subsequent logins [12].
The setup leaves records behind. Varonis says registering the malicious external method takes a change to the Authentication Methods Policy plus an application, a service principal and a consent grant [9]. That is four configuration objects, each of them enumerable in the tenant [2]. An organisation that uses no third-party MFA service has no legitimate entry of this kind, so the expected count in that part of the policy is zero [3].
Dirk-Jan Mollema presented the same registration path at x33fcon 2025, in a talk titled "Bringing Your Own Identity in Entra ID", showing that a rogue registered external MFA provider could satisfy an MFA requirement by returning a signed JWT claiming authentication had succeeded without performing the expected authentication check [11]. Varonis says TrustSink builds on that research and abuses the same trust for credential theft [16].
The 2025 work used the external provider to get past MFA. This one uses it to collect the passwords themselves, and the collection survives a reset [16][8].
What to watch
- Whether Microsoft tightens what Entra requires of an external MFA provider, or adds tenant alerting on Authentication Methods Policy changes.
- Any incident report placing a rogue external authentication method in a production tenant rather than a researcher's test tenant.
- Whether other identity providers using the same external authentication model issue guidance on monitoring these registrations.