New TrustSink attack steals passwords via rogue MFA provider

A new attack technique, dubbed TrustSink, has been developed by security researchers at Varonis Threat Labs that allows attackers with privileged access to register a rogue external multifactor authentication (MFA) provider. This malicious provider can then steal users' passwords during legitimate login attempts, with further coverage provided by Bleeping Computer.

The TrustSink attack exploits the trust Microsoft Entra places in configured external MFA providers. An attacker with a compromised privileged Entra account can register a rogue External Authentication Method (EAM). This EAM presents a convincing fake Microsoft password prompt to the user after their initial password entry. When the user re-enters their password, it is sent to the attacker's server. The rogue provider then sends a valid signed token back to Entra, completing the login process without suspicion. This technique requires prior compromise of a highly privileged account, such as a Global Administrator or Authentication Policy Administrator, making it a post-compromise attack.

Varonis recommends removing suspicious external MFA providers and their associated applications before resetting affected user passwords. They also advise limiting standing administrative privileges and adopting phishing-resistant authentication methods like FIDO2 or Windows Hello for Business to mitigate such risks.

Source: Bleeping Computer