Microsoft Rolls Out New Feature To MFA App, Prevents Spam Attacks

San Francisco: Microsoft has rolled out a new feature to its multi-factor authentication (MFA) app, Microsoft Authenticator, to prevent spam attacks. According to ZDNet, the company has rolled out ‘number matching’ in push notifications which will help prevent MFA attacks that rely on push notification spam.Also Read – Day After Firing 1,000 Employees, Microsoft Plans to Increase Hiring in Key Growth Areas | Read Full Plan Here

When ‘number matching’ is enabled, the Authenticator app asks the user to enter the number shown on the sign-on screen rather than just selecting “approve” when approving an MFA request. This will be a useful feature for admins whose users were unprepared for the MFA attack. Also Read – Microsoft Lays Off 1,000 Employees This Week Across Several Divisions. Here’s Why

The feature is available for the administrators for now, but the company wants to make ‘number matching’ the default for all Authenticator users in February 2023. Also Read – Here’s How Tech Companies Caught Employees For Moonlighting

To avoid unintentional approvals, administrators can also set up Authenticator to use application context and location context.

After the new feature becomes the Authenticator app’s default, the admin rollout controls will be removed.

Earlier this year, researchers discovered so-called “MFA fatigue attacks” targeting Office 365 users. In those attacks, attackers continually cause MFA push alerts while attempting to log into a victim’s account using a password that has previously been compromised.

The attacker was counting on the victim becoming tired or inattentive enough to approve the login attempt mistakenly at some time, the report said.