Rogue MFA Providers Exploit Entra ID for Password Theft

"In our test tenant, every sign-in completed normally while our server received passwords with timestamps and source IP addresses," explains Varonis.

TrustSink's attack flow in Microsoft Entra

Security researchers at Varonis Threat Labs developed a technique they call TrustSink that lets a rogue external multifactor authentication (MFA) provider steal plaintext passwords during otherwise legitimate sign-ins. The researchers demonstrated the technique against Microsoft Entra, which supports external MFA providers: after a user supplies a first factor such as a password on login.microsoftonline.com, Entra can redirect the browser to a configured external provider to complete the second factor.

Varonis showed a malicious External Authentication Method (EAM) can be registered so that, when Entra redirects to it for MFA, the rogue provider displays a convincing copy of Microsoft's password prompt. If the user re-enters their password on that page, the credential is delivered to the attacker-controlled server. The rogue provider then issues a valid signed token indicating the second factor succeeded; Entra accepts that token and completes the sign-in, leaving the user with a normal-looking session and no visible error.

How TrustSink builds on prior research

Varonis says TrustSink builds on research presented at x33fcon 2025 by security researcher Dirk-Jan Mollema, titled "Bringing Your Own Identity in Entra ID." Mollema's work showed that a registered external MFA provider could satisfy an MFA requirement simply by returning a signed JWT claiming authentication had succeeded, without performing the expected authentication check. TrustSink abuses that same mechanism not just to bypass MFA but to capture credentials by presenting a fake Microsoft password prompt during the redirected MFA step.

Privileged-account requirement: Global Administrator or Authentication Policy Administrator

Varonis emphasizes TrustSink is a post-compromise technique, not an initial-access attack. Registering the malicious external method requires modifying the Authentication Methods Policy and creating an application, service principal, and consent grant — actions that the researchers say require a Global Administrator or an Authentication Policy Administrator account. In short: an attacker must already control a highly privileged Entra account to install the rogue provider.

Persistence, password resets, and why capture continues

In the Varonis proof-of-concept, the rogue provider persisted in the tenant's Authentication Methods Policy after installation. That persistence had two operational consequences the researchers flagged: first, captured credentials arrived with metadata — Varonis reported receiving passwords "with timestamps and source IP addresses." Second, resetting a captured password did not eliminate the rogue provider; the provider remained in the authentication flow and captured the replacement password the next time the user signed in. Because the rogue method stays registered in the policy, Varonis recommends administrators remove the malicious provider before rotating affected credentials.

Varonis's recommended mitigations

• Remove suspicious external MFA providers and their associated applications, keys, and redirect URIs before resetting affected users' passwords.
• Monitor changes to the Authentication Methods Policy so additions or modifications to external providers are visible and can be investigated.
• Limit standing Global Administrator and Authentication Policy Administrator privileges to reduce the risk that a compromised privileged account can register rogue providers.
• Adopt phishing-resistant authentication methods such as FIDO2 or Windows Hello for Business to reduce reliance on password-based second-factor fallbacks.

What this means for technologists, procurement leaders, and end users

• Technologists and security teams: Carefully audit Authentication Methods Policy entries and any registered external MFA applications, service principals, and redirect URIs. Treat changes to those items as high-risk events that merit immediate investigation.
• Procurement leaders and platform owners: When contracting external MFA services, verify how the provider is instantiated in the authentication flow and require controls that prevent silent token issuance without verifiable authentication checks.
• End users: Be aware that a valid-looking password prompt can appear during MFA and that re-entering credentials on a redirected page may expose them even if the sign-in completes normally. Where available, enroll in phishing-resistant methods such as FIDO2 or Windows Hello for Business.

TrustSink is a reminder that trust placed in external authentication components can be weaponized if an attacker controls privileged configuration. The immediate, concrete steps Varonis outlines — removing suspicious providers before rotating passwords, monitoring Authentication Methods Policy changes, and reducing standing high-level administrative privileges — are actions organizations can take now to limit the window of exposure that a post-compromise rogue provider creates.

Original reporting: https://www.bleepingcomputer.com/news/security/rogue-external-mfa-providers-can-steal-passwords-during-logins/