Executive Summary
Varonis Threat Labs has detailed a credential-phishing technique called TrustSink that abuses the trust boundary between Microsoft Entra and External Authentication Method (EAM) providers. By compromising a Global Administrator or Authentication Policy Administrator account, an attacker can register a rogue OIDC provider. When MFA is triggered, users are redirected to this attacker-controlled provider, which displays a pixel-perfect imitation of a Microsoft password prompt. The provider captures the plaintext password and then returns a valid signed JWT to Entra to complete the login, leaving the user and the system unaware of the theft.
This technique provides significant persistence. Because the rogue provider remains registered in the tenant's authentication infrastructure, simple password resets are ineffective; the rogue provider will simply capture the new password at the user's next sign-in. This enables real-time, persistent harvesting of credentials for targeted groups or individuals within an organization.
The business impact is severe, as it allows for long-term stealthy access to enterprise resources. The urgency is high for organizations using external MFA integrations to audit their configurations and restrict administrative privileges to prevent the initial registration of rogue providers.