Your MFA Provider Could Be Stealing Your Password

Michael Miller · 2026-09-22

You know that little buzz on your phone when you log in? The one that makes you feel safe? Well, it turns out that same system might be handing your password to someone you've never met. Security researchers recently uncovered a nasty attack. Hackers with privileged access can register a rogue external MFA provider. Then, when you try to log in, that fake provider intercepts your credentials. It looks completely legitimate, so you don't suspect a thing. ### How the Attack Works It's a classic bait-and-switch. The attacker needs some level of access to your organization's systems first. Maybe they've already compromised an admin account. From there, they can add an external MFA provider to your setup. Once that's done, every time you log in, you're redirected to the attacker's server. You enter your username and password, and they grab it. Then they pass you along to the real MFA provider, so you get your code and everything seems normal. - **Step 1:** Attacker gains privileged access - **Step 2:** They register a rogue external MFA provider - **Step 3:** You log in and unknowingly send your password to the attacker - **Step 4:** Attacker uses your password to access your account ### Why This Is So Dangerous MFA is supposed to be your safety net. It's the thing that saves you even if your password gets leaked. But this attack flips that on its head. It uses MFA as the weapon. And because the fake provider looks just like the real one, you have no reason to be suspicious. You get your push notification, you approve it, and you go about your day. Meanwhile, your password is already in someone else's hands. > "The scariest part is that everything looks normal. You get your MFA prompt, you approve it, and you never know you've been compromised." - Security researcher ### What Can You Do About It? First, don't panic. This attack requires privileged access, so it's not something a random hacker can pull off. But it's a wake-up call for anyone who thinks MFA makes them invincible. Here are a few steps you can take: - **Limit privileged access:** Not everyone needs admin rights. Give them only to those who absolutely need it. - **Monitor MFA provider changes:** If someone adds a new external MFA provider, you should know about it immediately. - **Use phishing-resistant MFA:** Hardware keys like YubiKeys are much harder to spoof. - **Educate your team:** Make sure everyone knows the signs of a phishing attempt, even during MFA prompts. ### The Bottom Line MFA is still a powerful tool. You shouldn't ditch it. But you should understand its limits. No security measure is perfect, and attackers are always finding new ways to slip through the cracks. Stay vigilant. Keep an eye on your logs. And remember that even the tools designed to protect you can be turned against you if you're not careful. In the end, security is about layers. MFA is one layer. Don't let it be your only one.