Automatically confirming Cognito users after they complete NEW_PASSWORD_REQUIRED challenge

Question

In my application users are created using admin_create_user (which doesn't send a verification code, but a temporary password instead), but they all other functions are made through Cognito's API.

Problem is, how can I confirm this user email?

Ideally, I would like to confirm him after he changes his password for the first time in the NEW_PASSWORD_REQUIRED challenge.

How can I do this? Can I do this in a trigger? How can I do a trigger that knows that a NEW_PASSWORD_REQUIRED challenge succeeded?