Executive Summary
Varonis Threat Labs has identified a sophisticated credential-phishing technique termed TrustSink. This method exploits the trust relationship between Microsoft Entra and External Authentication Method (EAM) providers to insert a rogue authentication step into a legitimate sign-in flow. By registering a malicious OpenID Connect (OIDC) server, attackers can present a pixel-accurate password prompt to users that captures their credentials in plaintext while returning a valid, signed JWT to Entra to complete the login.
Technically, the attack involves registering a rogue provider in the Authentication Methods Policy, which requires high-level privileges such as Global Administrator or Authentication Policy Administrator. Once registered, the rogue provider intercepts the MFA redirect, harvests the user's password, and signs the authentication token using self-generated RSA keys. A critical finding is that standard password resets do not mitigate the threat; the rogue provider remains in the authentication flow and will capture any newly created passwords during the user's next login.
This technique represents a significant risk for persistent access and credential harvesting within large enterprises using Entra ID. Because the malicious prompt occurs within a trusted, expected sign-in flow, it is highly likely to deceive users. Security teams must prioritize monitoring for unauthorized changes to authentication infrastructure and identity-related configurations to prevent long-term compromise.