TrustSink: How a Rogue External MFA Provider Steals Passwords

Meet TrustSink, a technique that turns a rogue external MFA provider into a persistent credential trap. See how it works, why password resets may not remove the risk, and how defenders can detect rogue providers. Varonis Threat Labs…