Rogue external MFA providers can steal Microsoft Entra users’ passwords

Varonis researchers developed an attack technique called TrustSink in which an attacker who already controls a highly privileged Microsoft Entra account registers a rogue external MFA provider. The provider displays a copy of Microsoft’s password page during a legitimate sign-in and captures the password entered by the user.