Researchers showed that an attacker who already controls a highly privileged Microsoft Entra account can silently add a malicious external multi-factor authentication provider and trick users into re-entering their password during a normal login. The TrustSink technique abuses Entra External Authentication Methods (EAM): after the user signs in on Microsoft’s real login page, Entra redirects them to the rogue provider, which presents a fake Microsoft password prompt, captures the password in plaintext, then returns a signed token so the login completes normally.
Why it matters: Organizations that use Microsoft Entra with external MFA providers could have user passwords harvested without obvious signs once an admin-level Entra account is compromised. Defenders should audit Entra for registered external authentication providers, review privileged account access, and investigate unexpected password prompts during MFA steps.
Lawrence Abrams
2026.09.22
100% relevant
This article establishes a distinct story about the TrustSink credential-theft technique in Microsoft Entra’s external MFA flow; it does not match an existing tracked event in the list.
← Back to all stories