Tag: Rogue MFA

  • Rogue MFA Provider Can Steal Passwords During Legitimate Logins

    Rogue MFA Provider Can Steal Passwords During Legitimate Logins

    A rogue MFA provider can steal passwords while users complete an otherwise legitimate Microsoft Entra sign-in, according to Varonis Threat Labs. The researchers demonstrated the technique, called TrustSink, in a test environment. The attack requires a hacker to already control a highly privileged Entra account. It does not provide an initial way into an organization.…