TrustSink: An attacker with privileged access can deploy a rogue MFA provider to steal passwords

Varonis researchers described TrustSink, an attack in which an attacker who already controls a highly privileged Microsoft Entra account registers a rogue external MFA provider. The provider can display a copy of Microsoft's password page during a legitimate sign-in and collect the user's password in plaintext while the sign-in appears to complete normally.