Security Researchers Expose Rogue MFA Provider Attack That Can Harvest Passwords

Security researchers have demonstrated a new method by which attackers with privileged access can hijack multi‑factor authentication (MFA) flows by registering a malicious external MFA provider, allowing them to capture users' passwords during legitimate login attempts.

The attack exploits the way many organizations integrate third‑party MFA services. When a user logs in, the authentication system forwards the password to the configured external provider, which then returns a challenge—such as a one‑time code—to complete the MFA step. By inserting a rogue provider into this chain, an attacker can silently record the password before the MFA challenge is issued.

To carry out the exploit, the researcher‑team showed that an adversary who already possesses administrative or configuration rights can add a counterfeit MFA provider to the system’s trusted list. Once the fake provider is in place, any subsequent user login triggers a normal password submission to the malicious service, where the credentials are stored for later use. The user remains unaware, as the MFA challenge proceeds as usual.

This technique undermines the core security promise of MFA, which is to add an additional barrier beyond passwords. If the password itself is exfiltrated at the outset, the subsequent factor provides little protection. The researchers warn that any organization that relies on external MFA solutions without rigorous vetting of provider registrations could be vulnerable to large‑scale credential theft.

Following the proof‑of‑concept, the team disclosed the findings to affected vendors and highlighted several mitigation steps. Recommendations include tightening administrative permissions, implementing change‑control procedures for MFA provider configurations, and employing monitoring tools that alert on unexpected additions or modifications to authentication settings.

Security professionals are also urged to consider complementary defenses, such as certificate pinning for MFA communications, regular audits of third‑party integrations, and the use of internal, tightly controlled MFA mechanisms where feasible. Organizations should treat the MFA supply chain with the same scrutiny applied to other critical components of their security architecture.

The discovery serves as a reminder that while MFA dramatically raises the bar for attackers, it is not immune to supply‑chain attacks. Ongoing vigilance, proper access controls, and thorough provider vetting remain essential to preserving the integrity of authentication processes.