Reported by 4 outlets

Timeline

1. original reporting

   Microsoft Entra TrustSink Attack Uses Rogue MFA Provider to Steal Passwords

   gbhackers.com · 15d ago · September 28th, 2026

   TrustSink, a post-compromise credential-phishing technique that abuses Microsoft Entra External Authentication Methods (EAMs) to place a rogue password prompt inside an otherwise legitimate Microsoft sign-in flow. The attack enables an adversary with elevated tenant privileges to capture plaintext passwords while returning a valid signed token to Entra, allowing the victim’s login to complete without an […] The post Microsoft Entra TrustSink Attack Uses Rogue MFA Provider to Steal Passwords appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from winfuture.de

   Researchers name TrustSink: fake external MFA providers intercept Microsoft Entra passwords

   winfuture.de · 20d ago · September 23rd, 2026

   Researchers describe a new attack method called TrustSink: fake external MFA providers can intercept passwords in Microsoft Entra. The technique exploits trust relationships in multi-factor authentication flows. Source: winfuture.de

   via Mastodon https://winfuture.de/news,161471.html?utm_source=Mastodon&utm_medium=ManualStatus&utm_campaign=SocialMedia

3. update from baurnewmedia.de

   TrustSink: when the MFA provider becomes a password trap

   baurnewmedia.de · 19d ago · September 24th, 2026

   TrustSink: when the MFA provider becomes a password trap. External MFA providers in Microsoft Entra are considered safe, but the new attack me

   via Mastodon https://baurnewmedia.de/trustsink-wie-ein-manipulierter-mfa-anbieter-passwoerter-stiehlt-und-warum-passwort-resets-nicht-reichen/1733/

4. update from cyberpress.org

   Researchers Found an MFA Attack That Steals Passwords While Letting Users Log In Normally

   cyberpress.org · 15d ago · September 28th, 2026

   An attacker with Global Administrator or Authentication Policy Administrator privileges can register a rogue External Authentication Method (EAM) in Entra . Entra then treats the attacker-controlled service as an MFA provider for users assigned to it. The provider needs an application registration, a service principal and a publicly reachable HTTPS address. The user first enters their password on Microsoft’s real sign-in page. When MFA starts, Entra redirects the browser to the rogue provider. Instead of asking for a second factor, that provider displays a convincing copy of Microsoft’s password page. The provider then sends Entra a signed token claiming that the authentication check passed. In Varonis’s test tenant, users reached their applications without errors, while the researchers’ server received their passwords, timestamps and source IP addresses. The discovery document tells Entra where the provider lives (Source: varonis) Varonis built its proof of concept with a small OpenID Connect server. Its discovery document told Entra where to find the provider, while its public key let Entra verify returned tokens. The attack works because a valid token does not prove that the provider showed the user a genuine MFA challenge . The researchers’ server claimed a hardware-key check had succeeded after collecting a password instead.