New Microsoft Security feature to block Spam Attacks

Microsoft has rolled out a new feature to its multi-factor authentication (MFA) app, Microsoft Authenticator, to prevent spam attacks. The feature is expected to be available for all Authenticator users from next year.

 

The company has rolled out ‘number matching’ in push notifications which will help prevent MFA attacks that rely on push notification spam. When the feature is enabled, the Authenticator app asks the user to enter the number shown on the sign-on screen rather than just selecting “approve” when approving an MFA request.

 

Administrators can also set up Authenticator to use application context and location context to avoid unintentional approvals. After the new feature becomes the Authenticator app’s default, the admin rollout controls will be removed.

 

Earlier this year, researchers discovered so-called “MFA fatigue attacks” targeting Office 365 users. In those attacks, attackers continually cause MFA push alerts while attempting to log into a victim’s account using a password that has previously been compromised.