Varonis TrustSink: rogue Entra External Authentication Method steals plaintext passwords inside legitimate MFA flow
Varonis Threat Labs (Elad Ghvarh; blog 16 September 2026; BleepingComputer amplify 22 September 2026) documents TrustSink: a post-compromise technique that registers a rogue External Authentication Method (EAM) so the provider-controlled MFA step shows a pixel-accurate Microsoft-style password page and captures plaintext passwords (with timestamp and source IP) while returning a valid signed token so Entra still treats MFA as satisfied. Builds on the EAM trust boundary Dirk-jan Mollema highlighted (x33fcon 2025 “Bringing Your Own Identity”). Requires Global Administrator or Authentication Policy Administrator to change Authentication Methods Policy / app / service principal / consent — not an unauthenticated phishing kit. Password reset alone does not remove the rogue provider; it keeps capturing replacements on the next sign-in. Demo used a minimal FastAPI OIDC provider; real attackers need a public HTTPS endpoint. Defenders: audit EAMs and unexpected authentication-method policy changes before mass resets; remove rogue providers first. Primary: Varonis; docs: Microsoft Entra external method providers; wire: BleepingComputer 22 Sep 2026.
- Product
- Microsoft Entra ID External Authentication Methods (EAM) / third-party MFA providers
- Versions
- Technique applies where EAM is supported; demonstrated on Microsoft Entra
- Exploited in Australia?
- unknown
- Patch to
- No CVE: restrict who can alter Authentication Methods Policy (Global Admin / Auth Policy Admin); inventory and alert on new External Authentication Methods and related app/service-principal consent; remove rogue EAMs before forcing password resets; prefer phishing-resistant built-in methods where EAM is unused; review sign-in logs for unexpected external-method redirects
Primary: Varonis Threat Labs — TrustSink / rogue external MFA password trap (16 Sep 2026) · Vendor: Microsoft Learn — Entra external authentication method providers · BleepingComputer — Rogue external MFA providers (22 Sep 2026)