Microsoft has launched a new number matching feature in push notifications to help bolster its multi-factor authentication. The feature applies to the MFA app, Microsoft Authenticator. The new feature is available now and should help combat attacks that rely on push notification spam, the company says. The new feature comes after researchers identified attacks targeting Office 365 users during which attackers repeatedly trigger MFA push notifications while attempting to breach a victim’s account. The attack relies on the victim eventually clicking the notification, perhaps while distracted or bothered by the notifications.
The Authenticator app will now require the user to type in the number displayed on the sign-on screen rather than simply tapping approve. The feature will help combat authenticator attacks and generally improve security. Admins can enable number matching in Authenticator now, but Microsoft plans to make it the default setting by February.
Read More: Microsoft Authenticator gains feature to thwart spam attacks on MFA
