Changing your password is usually one of the first things you should do after a credential breach. But a new attack technique called TrustSink shows why that alone may not be enough. Researchers at Varonis Threat Labs have demonstrated how attackers can modify Microsoft Entra’s authentication flow and insert a fake password prompt into a legitimate login. The victim can enter the new password into that prompt and unknowingly hand it back to the attacker.
TrustSink abuses External Authentication Methods (EAM) in Microsoft Entra. The attacker first needs a highly privileged account that can change authentication settings. Varonis says this includes Global Administrator or Authentication Policy Administrator privileges, making this a post-compromise technique rather than a simple phishing attack.
After gaining the required access, the attacker registers a rogue external authentication provider and adds it to the sign-in process. The user can still start from Microsoft’s legitimate login page, enter their password and complete MFA. The browser is then redirected to the rogue provider, which displays a fake password prompt designed to look like part of the same authentication flow.
Read: Billions of Leaked Passwords Show Why Password Security Is Still Broken
The user enters the password again, but the attacker captures it. The rogue provider can then return a signed token to Microsoft Entra, allowing the login to continue without an obvious error. This is what makes TrustSink interesting. The victim does not necessarily have to click a suspicious link or visit a fake Microsoft website. The malicious prompt appears during a legitimate sign-in process.
The most important part of the research is what happens after the password is changed. With a normal credential theft attack, changing the compromised password can make the stolen password useless. TrustSink is different because the attacker has also changed the authentication configuration. Varonis tested the technique in its own tenant and found that the rogue provider remained active after a password reset. It could therefore capture the user’s new password during a later login.
That means resetting passwords should not be the only response if this type of compromise is discovered. The malicious authentication provider and related changes need to be removed and investigated first. Security teams should also look for unexpected changes to authentication policies, unfamiliar external authentication providers, new applications or service principals, and unusual permissions. Varonis says sign-in logs can provide additional clues through the issuer and authentication claims associated with the external provider.
The attack also shows why privileged identity accounts need strong protection. An attacker who gains access to an account capable of changing authentication policies can potentially affect the login process for other users, rather than simply stealing credentials from one account.
For everyday users, password managers remain useful even though they cannot stop TrustSink itself. Using a different, strong password for every account limits the damage when one credential is exposed. A password manager can generate and store those unique passwords, making it much easier to avoid password reuse across email, shopping, social media and other accounts.
Services such as NordPass and Proton Pass can make it easier to move away from reused passwords and keep credentials in one protected vault. Users should still combine unique passwords with MFA and, where supported, phishing-resistant authentication such as passkeys or security keys.
Read: Can Google Password Manager Replace Dedicated Password Managers?
TrustSink does not mean MFA has failed. It shows that attackers are increasingly targeting the systems around authentication rather than simply trying to steal a password. For organizations, protecting authentication configuration needs to be treated as seriously as protecting the credentials themselves.
A password can be changed. If someone has changed the system that handles your login, that system needs to be fixed first.
Related Posts
