TrustSink: How a Rogue External MFA Provider Steals Passwords

TrustSink is a post-compromise attack technique that allows a rogue external MFA provider to persistently harvest plaintext passwords during legitimate Microsoft Entra sign-ins—even after password resets—by inserting a convincing credential prompt into the authentication flow, making detection and removal of the rogue provider critical for defense.