Security researchers have discovered a method that allows attackers with privileged access to register a rogue external multi-factor authentication (MFA) provider. This malicious setup can capture users' passwords during legitimate login attempts, posing a significant risk to security. The attack exploits the trust users place in MFA systems, making them vulnerable to credential theft. Organizations that rely on MFA to protect user accounts need to be aware of this tactic, as it undermines the security benefits that MFA is supposed to provide. Users and companies alike must ensure that their MFA providers are legitimate and properly secured to prevent such attacks.