TrustSink Attack: Rogue MFA Providers Steal Microsoft Entra Passwords

How the Scam Works Mechanically

The TrustSink attack, developed by Varonis Threat Labs, exploits a feature in Microsoft Entra that allows organizations to integrate with external Multi-Factor Authentication (MFA) providers. Attackers who have already gained privileged access to an Entra environment can register a malicious, external MFA provider. When a legitimate user attempts to log in, after entering their initial password, Entra redirects them to this compromised external provider for the second authentication factor. Instead of a genuine MFA challenge, the rogue provider presents a convincing, fake Microsoft password prompt. If the user enters their password again, believing it's a necessary step in the authentication process, their credentials are sent directly to the attacker. The malicious provider then sends a valid token back to Entra, completing the login as if MFA was successful, leaving the user unaware their password has been stolen.

Warning Signs & Red Flags

• Unexpected password prompts during a login process, especially after already entering your password.
• Login flows that seem to take longer than usual or redirect to unfamiliar, yet convincing, login pages.
• The attack requires prior compromise of a highly privileged account, meaning the organization may already be experiencing other security issues.
• Once established, the rogue provider can persist, capturing passwords even after a user resets their credentials, until explicitly removed by an administrator.

How to Protect Yourself & Report

For end-users, vigilance is key. Be suspicious of any unexpected password re-entry requests during a login. If you suspect a phishing attempt or an unusual login process, do not proceed and report it immediately to your IT security department. For organizations utilizing Microsoft Entra with external MFA providers, administrators must be proactive. Regularly audit your Authentication Methods Policy for any unauthorized or suspicious external providers. Limit the number of accounts with Global Administrator or Authentication Policy Administrator privileges. Implement robust monitoring for changes to authentication policies. Varonis recommends removing any rogue external MFA providers, their associated applications, and redirect URIs before resetting passwords for potentially affected users. Prioritizing phishing-resistant authentication methods like FIDO2 security keys or Windows Hello for Business can significantly mitigate the risk of credential compromise.