TrustSink Attack Abuses Microsoft Entra External MFA to Steal Passwords
Security researchers at Varonis Threat Labs have developed an attack, dubbed TrustSink, that allows attackers who already control a highly privileged Microsoft Entra account to register a rogue external MFA provider that captures users' passwords during legitimate login attempts. The technique exploits the trust placed in external authentication methods, demonstrating how a compromised admin account can silently harvest credentials without disrupting the authentication flow.
