Rogue external MFA providers can steal passwords during logins

Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider, which steals users' passwords during legitimate login attempts. The technique exploits trust in external authentication services, allowing credential theft without triggering suspicion. Organizations should audit MFA provider configurations and restrict privileged access to prevent such attacks, as the method bypasses traditional security controls.