Researchers show privileged attackers can hijack MFA flows to capture plaintext passwords

Varonis Threat Labs demonstrated an attack called TrustSink that abuses external multifactor authentication providers to steal users' passwords during legitimate sign-ins. The method requires an attacker to already control a highly privileged account in a system like Microsoft Entra, then register a malicious provider that injects a fake password prompt. The captured passwords remain accessible even after users reset them, as the rogue provider stays in the authentication flow.

The attack chain begins only after an attacker has already seized control of a highly privileged account within Microsoft Entra, meaning it functions as a post-compromise escalation tool rather than an entry vector. Once registered, the rogue external authentication method intercepts the second-factor step, capturing credentials alongside timestamps and source IP addresses while the victim proceeds through an apparently normal sign-in.

Varonis researchers note the technique extends earlier work by security researcher Dirk-Jan Mollema, who demonstrated at x33fcon 2025 that a malicious external MFA provider could return a signed JWT falsely claiming successful authentication. TrustSink amplifies that concept by layering a convincing password-harvesting interface onto the same trust-abuse mechanism, and the rogue provider persists in the authentication flow even after users reset compromised passwords.