Security researchers at Varonis Threat Labs have disclosed an attack technique called TrustSink that abuses external multifactor authentication (MFA) providers to steal user passwords during legitimate login flows. The technique was demonstrated against Microsoft Entra but the researchers say it can work against any identity platform that supports the same external authentication model.

Microsoft Entra allows organizations to configure third-party services as external MFA providers. When a user authenticates with a password, Entra can redirect them to that external provider to complete the second factor. If the provider returns a valid signed token confirming MFA success, Entra treats the login as fully authenticated.

Varonis found that an attacker who already controls a highly privileged Entra account (Global Administrator or Authentication Policy Administrator) can register a malicious External Authentication Method that mimics a real MFA provider. Instead of prompting for a second factor, the rogue provider displays a convincing replica of Microsoft’s password entry page. Victims, expecting an additional authentication step, re-enter their password, which is captured in plaintext along with a timestamp and source IP by the attacker’s server.

The rogue provider then issues a valid signed token to Entra claiming MFA was completed, so the sign-in finishes without any visible error. Varonis says the fake page copies Microsoft’s fonts, layout, and button styling closely enough to be convincing, and it appears immediately after the user’s genuine password entry on the real login.microsoftonline.com domain.

Persistent even after password resets

Because the malicious provider stays registered in the tenant’s Authentication Methods Policy, resetting a compromised user’s password does not remove the threat. Varonis found the rogue provider simply recaptures the new password on the victim’s next login attempt.

TrustSink builds on earlier research by Dirk-Jan Mollema, presented at x33fcon 2025, which showed that a rogue external MFA provider could satisfy Entra’s MFA requirement by returning a fraudulent signed JWT without performing any real authentication check. Varonis extends that concept into a credential-theft technique.

Notably, TrustSink is a post-compromise technique, not an initial-access method. It requires an attacker to already hold highly privileged Entra credentials to register the rogue provider in the first place.

Recommended defenses

  • Remove suspicious external MFA providers along with their associated applications, keys, and redirect URIs before resetting affected passwords
  • Monitor changes to the Authentication Methods Policy for unauthorized modifications
  • Limit standing Global Administrator and Authentication Policy Administrator privileges
  • Adopt phishing-resistant authentication methods such as FIDO2 or Windows Hello for Business