Rogue external MFA providers can steal passwords during logins
-
Researchers have demonstrated an attack that allows a threat actor with privileged access to an environment to register a rogue external MFA provider, which then harvests user passwords during otherwise legitimate login attempts. Because the malicious provider is registered as part of the authentication flow, victims interact with it during normal sign-ins and may not notice anything unusual.
Key points:
- The attack requires the adversary to already hold privileged access, meaning it is typically a post-compromise or insider-style technique rather than a remote, unauthenticated exploit.
- The rogue provider captures credentials at the point users complete multi-factor authentication, so credentials are stolen in plaintext during a genuine login.
- Organizations relying on external or third-party MFA providers should review which providers are registered and trusted in their tenant, and audit who has permission to add them.
Mitigation guidance centers on tightening control over MFA provider registration, limiting privileged roles that can modify authentication configuration, and monitoring for unexpected changes to authentication methods.
Source: Unknown
Has your organization audited which external MFA providers are registered in its environment, and who has the rights to add new ones?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login