If your brain just said “but MFA!” with smug confidence, meet TrustSink — a sneaky trick that turns an extra layer of security into a pickpocket for credentials. Researchers showed that a maliciously registered external authentication service can pretend to be a legitimate second factor, ask for your password again, and quietly send that password to an attacker while the real login completes as if nothing happened.

The con in plain English

Here’s the short, weirdly elegant scam: some identity platforms let organizations outsource the second step of login to third-party services. If that external provider comes back with a signed token saying “yep, second factor done,” the identity system marks the MFA requirement as satisfied.

An attacker who already owns a very powerful admin account can register a bogus provider that mimics the usual flow. When the victim reaches the MFA step, their browser gets redirected to the attacker’s provider, which displays a page that looks exactly like the familiar password prompt. The user — already braced for another step — types their password again. Boom: the credential lands on the attacker’s server. The rogue provider then hands back a valid-looking token and the session proceeds without any error, so the user never suspects a thing.

Worse: this is a post-compromise play. You don’t get in with this trick alone — the attacker needs to have previously compromised a high-privilege account to set the fake provider up. Once in place, the rogue provider can keep harvesting passwords on subsequent sign-ins, and it can even snatch a newly reset password the next time the user logs in.

So how do you stop it?

Lucky for us, this attack depends on configuration and standing permissions, so defenders have clear (if slightly annoying) things to do. Recommended steps:

  • Check for and remove any suspicious external authentication services and their related applications, keys, and redirect URIs before changing compromised passwords.
  • Monitor and alert on changes to the tenant’s authentication methods or policies so you spot unexpected provider registrations fast.
  • Reduce the number of always-on Global Administrators or Authentication Policy Administrators; use just-in-time or break-glass approaches instead.
  • Prefer authentication that resists phishing altogether — for example, hardware-backed or platform-bound options instead of password+MFA prompts that can be faked.
  • When you do rotate credentials, double-check the authentication path hasn’t been tampered with before assuming a password reset fixed everything.

In short: TrustSink (and similar schemes) weaponize trust in external providers. Keep your admin keys under lock and surveillance, question any new authentication plumbing, and favor methods that can’t be casually spoofed. That way, your extra factor stays an extra layer — not an express lane for thieves.