Rogue external MFA providers can steal passwords during logins

Security researchers have demonstrated an attack where privileged threat actors can register a malicious external MFA provider, allowing them to harvest user passwords during legitimate authentication flows. This highlights the critical need for strict access controls on identity management platforms and continuous auditing of registered authentication methods in enterprise environments.