Repeated unauthorized Microsoft Authenticator sign-in requests

Question

Repeated unauthorized Microsoft Authenticator sign-in requests

Nhat Chau 0

Hello Microsoft Support Team,

I am experiencing repeated unauthorized sign-in approval requests through Microsoft Authenticator for my personal Microsoft account.

Issue description:

I receive unexpected sign-in approval requests that I did not initiate.

One suspicious attempt originated from an IP address geolocated to Gyeonggi-do, South Korea.

The operating system displayed was Windows.

The requests use Microsoft Authenticator's number-matching verification.

I have not attempted to sign in from this location or device.

I have not approved any of these suspicious requests.

Security concerns:

I suspect that someone may be attempting unauthorized access to my account, potentially through an MFA fatigue (push bombing) attack.

I am particularly concerned about why these authentication requests continue to reach my device despite not being initiated by me.

Questions for Microsoft:

Does receiving these number-matching requests indicate that an attacker already knows my account password, or can they be triggered without valid credentials?

How can I identify and block the source of these unauthorized sign-in attempts?

Is there a way to stop repeated unauthorized Authenticator prompts without disabling MFA?

Can Microsoft investigate whether my account has experienced a successful unauthorized login?

What additional security measures would Microsoft recommend to prevent these attacks?

I would appreciate guidance on securing my account and preventing further unauthorized authentication requests.

I can provide a redacted screenshot of the suspicious sign-in request if needed.

Thank you for your assistance.

0 comments

1 answer

Your answer

Answer 1

If someone knows your email alias for your personal account, the combination of passwordless account abilities and the need for a method to recover these same accounts created a logical anomaly for Microsoft that makes this situation possible, since passwordless recovery requires that only the primary alias or some other alias enabled for Sign-in be entered. IOW, it's a logical failure on Microsoft's part that led to the issue which allows for these types of MFA fatigue attacks.

Since the issue is that the attackers know your alias, the obvious fix is to change it, but most believe this will require them to switch entirely to this new email address for both that and other purposes as well, which isn't true.

To solve this, add the new alias to the account using something less obvious by possibly adding some numerals or other characters, then switch to that alias as primary which will be used for future logins, then go to the Sign-in preferences page to uncheck the original alias for only that purpose.

How to add an email address to your Microsoft account | Microsoft Support

Of course, you should keep the new alias a secret and never use it for any purpose like email or another that might expose it in public, since then the problem starts all over again. You'll keep the original alias for email and any other related use since it's still valid for those purposes, it'll just fail if anyone including the attackers tries to login with it, causing them to drop it from their lists and move on.

You'll also have to remember this new alias when logging in elsewhere, which is why I suggested adding a few characters, and you may want to suppress its display on your devices login page, so others don't learn it and try to use it or expose it publicly as well.

You've never been a direct risk of a breach, unless you mistakenly accepted the authenticator prompt, since the attackers only know your alias and nothing more. Even if they did know your password, it wouldn't matter as long as you didn't allow the second factor regardless of what that might be.

Rob