Varonis Threat Labs researchers uncovered an attack they named TrustSink, which exploits Microsoft Entra’s external multifactor authentication providers mechanism to steal users’ passwords during seemingly normal sign-in attempts. The attack relies on an attacker already possessing a highly privileged account within the Entra environment, rather than on an initial compromise beginning without privileges.
How does the attack work?
Microsoft Entra allows organizations to use external authentication services to complete the second sign-in factor. After the user enters the first factor, such as a password, Entra redirects the browser to the external MFA provider. If the provider returns a signed token indicating that the second factor has been completed, Entra considers authentication complete.
The researchers exploited this trust by registering a malicious External Authentication Method that appears to the service as a legitimate provider. When the user reaches the MFA step, the provider displays a spoofed page prompting for the Microsoft password instead of requesting the expected second factor. The password entered by the user reaches the attacker’s server, after which the provider returns a signed token to Entra so that sign-in completes without an error message.
The deception is more effective because the fake prompt appears immediately after the user enters the real password on a Microsoft domain, and it mimics the fonts, layout, and button design of the original sign-in page. From the victim’s perspective, access to the requested application continues normally.
What changes in practice?
The malicious provider can remain in the authentication path for targeted users through subsequent sign-in operations. According to Varonis, changing the password alone is not sufficient; the provider remained registered, allowing it to capture the new password during the next sign-in.
Installing the attack requires modifying the authentication methods policy and creating an application, a service principal, and a consent grant. These actions require a Global Administrator or Authentication Policy Administrator account, so the technique is classified as a post-compromise phase. TrustSink builds on earlier research presented by Dirk-Jan Mollema at the x33fcon 2025 conference concerning the ability of a maliciously registered external MFA provider to complete the authentication requirement through a signed JWT, but it adds credential theft to that capability.
What should administrators review?
Varonis recommends removing suspicious external MFA providers, along with their associated applications, keys, and redirect URLs, before resetting the passwords of affected users. Organizations should also monitor changes to the Authentication Methods Policy, reduce the permanent privileges of Global Administrator and Authentication Policy Administrator accounts, and use phishing-resistant methods such as FIDO2 or Windows Hello for Business.
The most important conclusion is that MFA does not eliminate the risks in the chain of trust of the components that implement it. If an attacker manages to control a suitable administrative account, a trusted external provider can become a point for capturing passwords while keeping the sign-in experience normal for the user.