Microsoft: TrustSink attack abuses Microsoft Entra ID to steal credentials

TrustSink Attack Exploits Microsoft Entra ID to Harvest Plaintext Passwords

A newly identified attack technique, TrustSink, exploits Microsoft Entra ID’s federated trust model to intercept user credentials in real time. Discovered by Smarter MSP, the method leverages a rogue multi-factor authentication (MFA) provider inserted into the legitimate authentication workflow, allowing attackers to capture plaintext passwords without user awareness.

Unlike traditional phishing attacks, TrustSink operates within trusted authentication infrastructure, making it difficult to detect with standard security tools. The attack targets organizations using Microsoft Entra ID with federated identity configurations, particularly those with weak governance or limited monitoring of external identity providers.

Once credentials are harvested, threat actors can authenticate as legitimate users, gaining access to sensitive corporate resources, cloud applications, and data. Stolen credentials may also enable lateral movement, privilege escalation, and long-term persistence within compromised systems. The risks include data breaches, regulatory violations, and reputational damage for affected organizations.

Source: https://www.msspalert.com/brief/trustsink-attack-abuses-microsoft-entra-id-to-steal-credentials

Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-entra

"id": "mic1791246210",
"linkid": "microsoft-entra",
"type": "Cyber Attack",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'type': 'Organizations'}],
 'attack_vector': 'Rogue MFA Provider in Federated Identity Workflow',
 'data_breach': {'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': 'User credentials (plaintext '
                                             'passwords)'},
 'description': 'A newly identified attack technique, TrustSink, exploits '
                'Microsoft Entra ID’s federated trust model to intercept user '
                'credentials in real time. The method leverages a rogue '
                'multi-factor authentication (MFA) provider inserted into the '
                'legitimate authentication workflow, allowing attackers to '
                'capture plaintext passwords without user awareness. Unlike '
                'traditional phishing attacks, TrustSink operates within '
                'trusted authentication infrastructure, making it difficult to '
                'detect with standard security tools.',
 'impact': {'brand_reputation_impact': 'Reputational damage',
            'data_compromised': 'User credentials (plaintext passwords)',
            'identity_theft_risk': 'High',
            'legal_liabilities': 'Regulatory violations',
            'operational_impact': 'Lateral movement, privilege escalation, '
                                  'long-term persistence within compromised '
                                  'systems',
            'systems_affected': 'Microsoft Entra ID with federated identity '
                                'configurations'},
 'post_incident_analysis': {'root_causes': 'Weak governance or limited '
                                           'monitoring of external identity '
                                           'providers in Microsoft Entra ID '
                                           'federated trust model'},
 'references': [{'source': 'Smarter MSP'}],
 'title': 'TrustSink Attack Exploits Microsoft Entra ID to Harvest Plaintext '
          'Passwords',
 'type': 'Credential Harvesting',
 'vulnerability_exploited': 'Weak governance or limited monitoring of external '
                            'identity providers in Microsoft Entra ID '
                            'federated trust model'}