varonis.com

TrustSink Uses a Rogue Entra Authentication Provider to Steal Passwords

Varonis researchers demonstrate TrustSink, a technique that uses a rogue Entra external authentication provider to capture plaintext passwords during sign-in and return a valid token, keeping the trap active even after password resets.

Sep 23, 2026

AvisLoader Windows Malware Uses Tox P2P for Command-and-Control

Varonis researchers analyzed AvisLoader, a Windows loader delivered through a ClickFix lure. It uses encrypted Tox peer-to-peer messaging for command-and-control and includes artifacts for shortcut persistence, elevation bypass, and process hiding.

Sep 16, 2026