THREAT OPS › Threat News › TrustSink: How a Rogue External MFA Provider Steals Passwords
TrustSink: How a Rogue External MFA Provider Steals Passwords
<p><a href="https://www.varonis.com/varonis-threat-labs?hsLang=en">Varonis Threat Labs</a> identified a credential-phishing technique we call TrustSink. It turns a trusted external authentication provider into a persistent credential trap within a legitimate sign-in flow.</p> <p>While the technique can work in any provider, we demonstrated TrustSink end-to-end using Microsoft Entra. An attacker w
MITRE ATT&CK techniques
Indicators of compromise
- https://trident-sip-filter.ngrok-free.devurl
- https://login.microsoftonline.com/common/federation/externalauthproviderurl
- https://trident-sip-filter.ngrok-free.dev/eam/.well-known/openid-configurationurl
- https://varonis.wistia.com/s/trust-sink-manualurl
- auth-verify.microsoft-sso.comdomain
- track.hubspot.comdomain
- 2fwww.varonis.comdomain
- 252fwww.varonis.comdomain
Original source: https://www.varonis.com/blog/trustsink