Security researchers at Varonis Threat Labs have disclosed TrustSink, a post-compromise attack that abuses Microsoft Entra’s External Authentication Method (EAM) feature to silently steal passwords from users during normal logins. The attack requires an adversary to already control a highly privileged Entra account — making it a persistence and lateral movement technique rather than an initial-access exploit — but once in place, it is difficult for victims to detect or shake.
Microsoft Entra supports external MFA providers, letting organizations route second-factor authentication through third-party services. The design assumption is that any provider registered in Entra is trusted. Varonis found that an attacker with sufficient privileges can register a malicious provider that, instead of presenting a real second-factor challenge, displays a convincing copy of Microsoft’s password prompt. When a user signs in, Entra redirects them to this fake provider for MFA. The fake provider records the submitted password in plaintext, then returns a valid signed token to Entra — so the login completes normally without any error shown to the user. “In our test tenant, every sign-in completed normally while our server received passwords with timestamps and source IP addresses,” the researchers noted. In testing, resetting a captured password did not remove the rogue provider from the authentication flow — meaning the attacker captures the replacement password at the very next login.
How to check if you’re affected
Affected products are any organization using Microsoft Entra with External Authentication Methods enabled. Defenders should audit configured external MFA providers in their Entra tenant for any entries that are unfamiliar or were added without change-management approval. Microsoft has been notified of the technique.