Varonis Threat Labs uncovered TrustSink, a credential-phishing technique that abuses a rogue External Authentication Method in Microsoft Entra to capture plaintext passwords while still returning a valid signed token. The attack requires privileged access to register the provider, persists across password resets, and leaves detectable traces in authentication policy changes, application registrations, service principals, and sign-in logs. #TrustSink #MicrosoftEntra #ExternalAuthenticationMethod #VaronisThreatLabs
Keypoints
- TrustSink turns a trusted external authentication provider into a persistent password trap inside a normal Microsoft Entra sign-in flow.
- The technique was demonstrated end-to-end using Microsoft Entra with a rogue External Authentication Method (EAM) provider.
- A high-privilege attacker can register the provider, show a fake Microsoft password page to the user, and capture the password in plaintext.
- Entra accepts a signed token from the rogue provider, so the login completes without errors even though the password was stolen.
- Resetting the victimās password does not remove the rogue provider, allowing the trap to capture the new password on the next sign-in.
- TrustSink requires post-compromise privileges such as Global Administrator or Authentication Policy Administrator access to alter the Authentication Methods Policy.
- Defenders should monitor authentication policy changes, app registrations, service principals, consent grants, and sign-in logs for suspicious issuer and claim patterns.
MITRE Techniques
- [T1136 ] Create Account ā The attacker creates a rogue application and related service principal to support the malicious authentication provider (ācreating an application, a service principal, and a consent grantā).
- [T1098 ] Account Manipulation ā The attacker modifies authentication infrastructure by registering an External Authentication Method and changing the Authentication Methods Policy (āchange the Authentication Methods Policyā, āregister the providerā).
- [T1556 ] Modify Authentication Process ā TrustSink abuses the sign-in flow by inserting a fake password page and returning a signed token to complete authentication (āplace a convincing password page inside the legitimate sign-in flowā, āreturns a valid signed tokenā).
- [T1110 ] Brute Force ā The article describes repeated password collection attempts during sign-in, enabling credential capture on each login rather than traditional guessing (ācaptured the replacement password at the userās next sign-inā).
- [T1056 ] Input Capture ā The rogue page captures plaintext passwords directly from the user as they are entered (āour server received passwordsā).
- [T1078 ] Valid Accounts ā The attack relies on compromised privileged identities and uses legitimate sign-in flows to authenticate (āan attacker with high privilegesā, āpost-compromise techniqueā).
- [T1649 ] Steal or Forge Authentication Certificates ā The attacker signs tokens with a generated key pair and uses the resulting signature to convince Entra the provider is legitimate (āsigns the token with the providerās private keyā, āvalidate the tokensā).
- [T1105 ] Ingress Tool Transfer ā The provider and deployment tools are delivered and used via external infrastructure and tunneling to expose the malicious service (āngrokā, āpublic HTTPS addressā).
Indicators of Compromise
- [Domains/URLs ] malicious provider and callback infrastructure used in the demo ā trident-sip-filter.ngrok-free.dev, login.microsoftonline.com/common/federation/externalauthprovider
- [Application/Policy names ] innocuous app and blended-in provider label used during setup ā Security Verification, Userās Password
- [Endpoint paths ] provider endpoints used for discovery, key retrieval, authorization, and capture ā /.well-known/openid-configuration, /jwks
- [File names ] deployment and cleanup automation artifacts ā deploy.py, cleanup_eam.py, deploy_state.json
- [HTTP user-agent/header ] automated Graph activity associated with the deployment script ā python-requests/2.33.1
- [Claims/strings ] suspicious token claims used to satisfy MFA ā acr: āpossessionorinherenceā, amr: [āhwkā]
Read more: https://www.varonis.com/blog/trustsink