Executive Summary
Security researchers at Varonis Threat Labs discovered TrustSink, a sophisticated attack technique that allows threat actors with privileged Microsoft Entra access to register malicious external MFA providers. The attack works by intercepting legitimate login attempts and presenting users with convincing fake Microsoft password prompts, capturing credentials in plaintext while allowing authentication to complete normally. Once deployed, the rogue provider remains persistent in the authentication flow, capturing passwords even after credential resets, making it particularly dangerous for credential harvesting operations.
This technique highlights the growing sophistication of identity-based attacks as organizations increasingly rely on federated authentication and external MFA providers. With threat actors continuously evolving their tactics to exploit trusted authentication mechanisms, the TrustSink attack demonstrates critical vulnerabilities in multi-factor authentication implementations.
Why This Matters Now
TrustSink exposes fundamental weaknesses in federated authentication trust models, demonstrating how attackers can weaponize legitimate MFA infrastructure for persistent credential theft, making this particularly urgent as organizations accelerate cloud identity adoption.
Attack Path Analysis
Attacker compromises highly privileged Entra account through initial access vector, then escalates privileges to Global Administrator or Authentication Policy Administrator role. Using these elevated privileges, attacker registers malicious External Authentication Method (EAM) provider in tenant's Authentication Methods Policy. When legitimate users attempt to sign in, the rogue MFA provider intercepts authentication flow and presents fake Microsoft password prompt to harvest credentials. Captured passwords are exfiltrated to attacker-controlled server with timestamps and source IP addresses. Attack persists across password resets, continuously harvesting new credentials and maintaining unauthorized access to user accounts.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker gains access to highly privileged Entra account through unspecified initial access vector, obtaining credentials for Global Administrator or Authentication Policy Administrator account
MITRE ATT&CK® Techniques
Valid Accounts: Cloud Accounts
Modify Authentication Process: Hybrid Identity
Multi-Factor Authentication Request Generation
Forge Web Credentials: SAML Tokens
Unsecured Credentials: Credentials In Files
Modify Authentication Process: Multi-Factor Authentication
Data from Information Repositories: Code Repositories
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Multi-factor authentication for all access
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Multi-Factor Authentication
Control ID: 500.12
CISA ZTMM 2.0 – Identity and Access Management
Control ID: ID.AM-6
DORA – Identification and classification of ICT risk
Control ID: Article 8
NIS2 Directive – Cybersecurity risk management measures
Control ID: Article 21
ISO 27001:2022 – User registration and de-registration
Control ID: A.9.2.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Financial Services
Critical exposure to rogue MFA provider attacks targeting privileged accounts, with compliance risks across PCI and regulatory frameworks requiring immediate authentication policy review.
Health Care / Life Sciences
Severe HIPAA compliance violations from credential theft through compromised external authentication methods, requiring enhanced monitoring of authentication policy changes and privilege escalation controls.
Information Technology/IT
High-value targets for TrustSink attacks given extensive Microsoft Entra usage and privileged access requirements, necessitating phishing-resistant authentication and zero trust segmentation implementation.
Government Administration
Significant national security implications from post-compromise credential harvesting through malicious external MFA providers, demanding immediate authentication policy administrator privilege restrictions and FIDO2 deployment.
Sources
- Rogue external MFA providers can steal passwords during loginshttps://www.bleepingcomputer.com/news/security/rogue-external-mfa-providers-can-steal-passwords-during-logins/Verified
- TrustSink: Abusing External Authentication Methods in Microsoft Entrahttps://www.varonis.com/blog/trustsinkVerified
- External authentication method providers - Microsoft Entra IDhttps://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-providerVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would constrain this Entra ID authentication hijacking attack by limiting lateral movement scope and controlling external communication paths. The segmented architecture would likely reduce the blast radius of compromised privileged accounts and restrict unauthorized credential harvesting operations.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Identity-aware routing and segmented access controls would likely limit the scope of administrative account compromise, constraining attacker reach to specific network segments and reducing exposure of critical authentication infrastructure components.
Control: Zero Trust Segmentation
Mitigation: Microsegmentation policies would likely constrain administrative actions to authorized network paths, potentially limiting the attacker's ability to modify authentication policies across the entire tenant and reducing the scope of malicious provider registration activities.
Control: East-West Traffic Security
Mitigation: East-west traffic inspection and segmentation would likely limit the malicious authentication provider's reach across user populations, constraining the scope of credential harvesting by restricting unauthorized authentication flow modifications to specific user segments.
Control: Multicloud Visibility & Control
Mitigation: Distributed security visibility would likely detect and constrain unauthorized external communications from authentication infrastructure, limiting the attacker's ability to establish persistent command channels and reducing the scope of credential transmission to external servers.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely block or constrain unauthorized data transmission from authentication services to external destinations, limiting the attacker's ability to exfiltrate harvested credentials and reducing the volume of compromised user data leaving the environment.
Residual impact would likely involve compromised user accounts within accessible network segments, though the scope would be constrained to specific zones rather than organization-wide credential harvesting, limiting the overall blast radius of the persistent authentication compromise.
Impact at a Glance
Affected Business Functions
- Identity and Access Management
- User Authentication Systems
- Enterprise Application Access
- Security Operations
Estimated downtime: N/A
Estimated loss: N/A
User credentials including plaintext passwords, usernames, timestamps, and source IP addresses captured during legitimate authentication attempts. The attack maintains persistence across password resets until the rogue provider is manually removed.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to enforce least privilege access and prevent lateral movement between authentication systems and user workloads
- • Deploy Multicloud Visibility & Control to monitor changes to Authentication Methods Policy and detect suspicious external MFA provider registrations
- • Enable Egress Security & Policy Enforcement to block unauthorized outbound communications from rogue MFA providers to external command and control servers
- • Establish Threat Detection & Anomaly Response capabilities to baseline normal authentication flows and alert on anomalous MFA provider behavior patterns
- • Configure Cloud Native Security Fabric controls to inspect authentication traffic in real-time and prevent malicious credential harvesting during login flows
