<![CDATA[Rogue external MFA providers can steal passwords during logins]]>Researchers have demonstrated an attack that allows a threat actor with privileged access to an environment to register a rogue external MFA provider, which then harvests user passwords during otherwise legitimate login attempts. Because the malicious provider is registered as part of the authentication flow, victims interact with it during normal sign-ins and may not notice anything unusual.

Key points:

  • The attack requires the adversary to already hold privileged access, meaning it is typically a post-compromise or insider-style technique rather than a remote, unauthenticated exploit.
  • The rogue provider captures credentials at the point users complete multi-factor authentication, so credentials are stolen in plaintext during a genuine login.
  • Organizations relying on external or third-party MFA providers should review which providers are registered and trusted in their tenant, and audit who has permission to add them.

Mitigation guidance centers on tightening control over MFA provider registration, limiting privileged roles that can modify authentication configuration, and monitoring for unexpected changes to authentication methods.

Source: Unknown

Has your organization audited which external MFA providers are registered in its environment, and who has the rights to add new ones?

]]>https://xploitlk.com/topic/430/rogue-external-mfa-providers-can-steal-passwords-during-loginsRSS for NodeTue, 27 Oct 2026 08:56:31 GMTTue, 22 Sep 2026 22:30:18 GMT60