Something’s off.A reported technique called TrustSink shows how an attacker who already controls a highly privileged Microsoft Entra account could register a malicious external MFA provider. During a normal-looking sign-in, that provider could reportedly show an extra password prompt instead of a second-factor challenge.
The unusual part is that the user’s login could still complete after the password is entered: the rogue provider would return a signed result saying the MFA step was finished. The researchers further claim that simply resetting the captured password would not remove the provider, so a replacement password could be collected at the next login unless the rogue provider is removed first.
UNVERIFIED
Feed metadata identifies a report, not independently verified underlying facts.
This report has not been independently verified.
