Affected Systems
Microsoft Entra ID (formerly Azure AD) environments using external MFA providers. Requires attacker to already control a Global Administrator or Authentication Policy Administrator account. Any organization relying on external authentication methods for MFA is potentially affected.
Exploitation Status
Proof-of-concept demonstrated by Varonis Threat Labs. Technique named TrustSink. Builds on prior research by Dirk-Jan Mollema (x33fcon 2025). No evidence of active exploitation in the wild reported.
Business Impact
Post-compromise persistence and credential theft technique. Attackers with privileged Entra access can register malicious external MFA providers that intercept plaintext passwords during legitimate logins. Victims see no error; rogue provider persists across password resets until manually removed. Enables long-term credential harvesting with timestamps and source IPs. Requires highly privileged account compromise first, limiting initial attack surface but enabling persistent credential theft after breach.
Urgency
🟡 Within a week
Recommended Actions
- Audit Microsoft Entra Authentication Methods Policy for unauthorized external MFA providers; remove suspicious entries, associated applications, service principals, and redirect URIs before rotating credentials
- Enable monitoring and alerting for changes to Authentication Methods Policy, especially registration of new External Authentication Methods (EAM)
- Enforce Privileged Identity Management (PIM) for Global Administrator and Authentication Policy Administrator roles; eliminate standing privileged access
- Deploy phishing-resistant MFA methods (FIDO2 security keys, Windows Hello for Business, certificate-based authentication) to reduce reliance on external MFA providers
- Review Entra ID sign-in logs for anomalous MFA redirects or authentication flows involving external providers; correlate with Authentication Methods Policy change events