NewsPublished 22 Sep 2026

Rogue external MFA providers can steal passwords during logins

Source Bleeping Computer

Description

Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users' passwords during legitimate login attempts. [...]

Impact

An attacker who has already compromised a highly privileged Microsoft Entra account can steal user passwords during legitimate login attempts by inserting a rogue external MFA provider. This allows persistent credential theft even after password resets, potentially leading to further account compromise and lateral movement within the organization. The attack does not provide initial access but enables ongoing credential harvesting from targeted users.

Defensive guidance

Organizations should promptly remove any suspicious external MFA providers and their associated applications, keys, and redirect URIs before resetting affected users' passwords. Limit standing Global Administrator and Authentication Policy Administrator privileges to reduce risk. Employ phishing-resistant authentication methods such as FIDO2 or Windows Hello for Business to mitigate this attack vector. Monitor changes to the Authentication Methods Policy for unauthorized modifications. Since this is a post-compromise technique, focus on preventing initial privilege escalation and promptly detecting and responding to high-privilege account compromises.

Summary

TrustSink is a post-compromise attack demonstrated against Microsoft Entra's external MFA provider model. An attacker with Global Administrator or Authentication Policy Administrator privileges can register a rogue external MFA provider that intercepts the second-factor authentication step. Instead of a legitimate MFA challenge, the rogue provider presents a fake Microsoft password prompt, capturing the user's password in plaintext. It then returns a valid signed token to Entra, allowing the login to complete normally without alerting the user. The rogue provider persists in the authentication flow, capturing replacement passwords on subsequent logins until explicitly removed. The attack exploits the trust Microsoft places in configured external MFA providers and requires modification of the Authentication Methods Policy and creation of associated applications and consent grants.

References

bleepingcomputer.com/news/security/rogue-external-mfa-providers-can-steal-passwords-during-logins/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Sep 2026, 22:02 UTC

References

Community reviews