Sunday 4 October 2026
Afternoon EditionRSS
ZOTPAPER

News without the noise

ZOTPAPER
Security

TrustSink Attack Abuses Microsoft Entra External MFA to Steal Passwords

Researchers demonstrate how attackers with privileged access can inject fake password prompts into legitimate logins

By LineZotpaper
Published
Read Time2 min
Security researchers at Varonis Threat Labs have developed an attack, dubbed TrustSink, that allows attackers who already control a highly privileged Microsoft Entra account to register a rogue external MFA provider that captures users' passwords during legitimate login attempts. The technique exploits the trust placed in external authentication methods, demonstrating how a compromised admin account can silently harvest credentials without disrupting the authentication flow.

The TrustSink attack, detailed by Varonis Threat Labs and reported by BleepingComputer on September 22, 2026, targets organizations using Microsoft Entra's support for external MFA providers. These providers allow companies to integrate third-party authentication services for multifactor authentication. When a user signs in, Entra can redirect them to an external provider for a second factor; if the provider returns a signed token confirming completion, Entra accepts the MFA as satisfied.

Varonis found that an attacker with a highly privileged Entra account can register a malicious External Authentication Method (EAM) as such a provider. During a user's login, the rogue provider displays a convincing copy of Microsoft's password prompt instead of a legitimate second-factor challenge. If the victim re-enters their password, the credential is sent to the attacker's server. The malicious provider then generates a valid signed token to Entra, allowing the login to complete without error.

According to Varonis, resetting a captured password did not remove the rogue provider; it remained in the authentication flow and captured the replacement password at the user's next sign-in. The researchers emphasized that TrustSink is not an initial-access attack — it requires the attacker to already control a highly privileged Entra account.

§

Analysis

Why This Matters

  • Organizations using external MFA providers in Microsoft Entra could have their users' passwords silently stolen if an admin account is compromised.
  • The attack persists even after password resets, meaning the rogue provider can capture new credentials indefinitely.
  • This highlights a fundamental trust issue: Entra treats a signed token from an external provider as proof of MFA completion without verifying the challenge presented to the user.

Background

Microsoft Entra supports external authentication methods (EAMs) to let organizations use third-party MFA services. The feature is designed for flexibility, allowing enterprises to integrate legacy or specialized authentication systems. However, it relies on a trust model where Entra accepts a signed token from the external provider as sufficient proof of second-factor verification. Varonis's TrustSink attack demonstrates that this trust can be weaponized if an attacker gains administrative privileges in Entra — allowing them to register a malicious provider that intercepts credentials while still satisfying the MFA requirement.

Key Perspectives

Security Researchers (Varonis Threat Labs): Their proof-of-concept shows a realistic attack vector that exploits the gap between what Entra trusts (a signed token) and what the user experiences (a fake password prompt). They emphasize the need for more rigorous validation of external authentication flows.

Microsoft: As the platform provider, Microsoft designed the external MFA feature to meet enterprise needs. The attack requires highly privileged account access first, which Microsoft would argue should be protected with strong security measures (e.g., Privileged Identity Management, Conditional Access). However, the TrustSink method shows that even after such access is gained, the damage can extend far beyond typical admin misuse.

Enterprise Administrators: Organizations using external MFA providers must carefully manage privileged Entra accounts and monitor for rogue EAM registrations. The attack underscores the importance of least-privilege principles and auditing of authentication methods.

What to Watch

  • Microsoft's response: Will the company update Entra to validate the actual authentication challenge presented by external providers, or restrict the registration of external methods?
  • Adoption of passwordless authentication: If organizations move away from passwords entirely, this password-stealing variant loses effectiveness, but the underlying trust issue may remain.
  • Audit logs: Administrators should monitor for unexpected addition of external authentication methods and review MFA provider configurations regularly.

Sources

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workReport an errorSubscribe