TrustSink is a post-compromise attack demonstrated against Microsoft Entra's external MFA provider model. An attacker with Global Administrator or Authentication Policy Administrator privileges can register a rogue external MFA provider that intercepts the second-factor authentication step. Instead of a legitimate MFA challenge, the rogue provider presents a fake Microsoft password prompt, capturing the user's password in plaintext. It then returns a valid signed token to Entra, allowing the login to complete normally without alerting the user. The rogue provider persists in the authentication flow, capturing replacement passwords on subsequent logins until explicitly removed. The attack exploits the trust Microsoft places in configured external MFA providers and requires modification of the Authentication Methods Policy and creation of associated applications and consent grants.

An attacker who has already compromised a highly privileged Microsoft Entra account can steal user passwords during legitimate login attempts by inserting a rogue external MFA provider. This allows persistent credential theft even after password resets, potentially leading to further account compromise and lateral movement within the organization. The attack does not provide initial access but enables ongoing credential harvesting from targeted users.

Organizations should promptly remove any suspicious external MFA providers and their associated applications, keys, and redirect URIs before resetting affected users' passwords. Limit standing Global Administrator and Authentication Policy Administrator privileges to reduce risk. Employ phishing-resistant authentication methods such as FIDO2 or Windows Hello for Business to mitigate this attack vector. Monitor changes to the Authentication Methods Policy for unauthorized modifications. Since this is a post-compromise technique, focus on preventing initial privilege escalation and promptly detecting and responding to high-privilege account compromises.