Microsoft Authenticator - Constant Login Approval Requests


Recommended Posts

So for the last few days, and excuse me if I'm not posting in the correct place... anyway, for the last few days I have been getting constant login approval requests from Microsoft Authenticator. I thought maybe someone was trying to get in so I changed my password and backup info... it did stop for a bit after, but now, it's back. I've had maybe 10 today alone. I check the history and there is nothing there.... under my recent activity it just lists my login to view the page, and my last login attempt which I signed into Outlook on my phone on June 18. What is going on? It's asking me to 'type in the code' that's displayed on my screen. I'm not doing it! Anyone else? Anything I should dig deeper into?

Hello,

What sort of Microsoft Authenticator account login approval requests are you getting?  It is a generic authentication app and can be used with all sorts of services (Microsoft Account, Google Account, websites and services that support multi-factor authentication, etc.).

Regards,

Aryeh Goretsky

On 25/06/2026 at 03:27, goretsky said:

Hello,

What sort of Microsoft Authenticator account login approval requests are you getting?  It is a generic authentication app and can be used with all sorts of services (Microsoft Account, Google Account, websites and services that support multi-factor authentication, etc.).

Regards,

Aryeh Goretsky

It's requesting a login code as if I was signing into my account on my Windows machine. 

If you look at the account logs more than likely it will be showing that the request is coming from Valley Nebraska. we have been seeing thousands of these the last day or so.

On 25/06/2026 at 00:04, jbarcus81 said:

So for the last few days, and excuse me if I'm not posting in the correct place... anyway, for the last few days I have been getting constant login approval requests from Microsoft Authenticator. I thought maybe someone was trying to get in so I changed my password and backup info... it did stop for a bit after, but now, it's back. I've had maybe 10 today alone. I check the history and there is nothing there.... under my recent activity it just lists my login to view the page, and my last login attempt which I signed into Outlook on my phone on June 18. What is going on? It's asking me to 'type in the code' that's displayed on my screen. I'm not doing it! Anyone else? Anything I should dig deeper into?

Do not enter the code under any circumstances, or you will be sorry. It's definitely and most likely a hacking attempt.  That happened to me a couple of years ago, and I kept receiving those prompts for months.

It's simply the attacker trying to get you tired of the constant requests, so you just give up and enter the code, so they can log in to your account. 

Sounds like someone knows your email address and is repeatedly trying to log in, hoping you'll approve the MFA request (MFA fatigue). Definitely don't approve any prompts you didn't initiate. I'd also check that no unknown devices are signed into your account, sign out of all sessions, and consider changing your email.

On 25/06/2026 at 17:02, The_Focal_Point said:

Sounds like someone knows your email address and is repeatedly trying to log in, hoping you'll approve the MFA request (MFA fatigue). Definitely don't approve any prompts you didn't initiate. I'd also check that no unknown devices are signed into your account, sign out of all sessions, and consider changing your email.

Yeah, I signed out of everything when I changed the password to my account. I keep checking device history and there's never anything new other than my own activity. 

On 25/06/2026 at 10:40, _neutrino said:

If you look at the account logs more than likely it will be showing that the request is coming from Valley Nebraska. we have been seeing thousands of these the last day or so.

I checked on the IPs associated with every login and they're all mine... And whenever I get a new prompt, there is no activity to show for it. 

Hello,

Were you using a product or service from one of the companies affected by the Klue data breach?  See https://klue.com/blog/an-update-on-recent-klue-security-incident for the company's public statement.  That blog post does not list affected customer.

From looking around at reports, I created this list:

  • Gong
  • HackerOne
  • Huntress
  • Insurity
  • Jamf
  • LastPass
  • OneTrust
  • Recorded Future
  • ReliaQuest
  • Salesforce
  • Snyk
  • Sprout Social
  • Tanium

It is likely there are other companies affected as well.

Regards,

Aryeh Goretsky
 

@goretsky I will keep those in mind for the calls we get and update our technicians with the list, im sure the list will grow and I hope there is a larger public statement on this. 

Here is the statement from Huntress
https://www.huntress.com/blog/klue-breach-investigation

 

 

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • So you think I voted out because i am anti-immigrant. I am fed up with those that come over and think that we owe them something. The ones that are at the moment coming over from France where they are already in a safe country because they think and no doubt will get everything chucked at them. While people who were born and bred here get very little. I have nothing against as i have said before those that come here and work. In fact I know full well that our NHS would struggle without them. I do have a problem with those that come over here and try to push their religion and their way of life onto us. My reasons for voting out was because of what the E.U is and is also becoming. I did not agree with Freedom of movement, not because I don't want people over here, but because people need to be checked before being allowed to cross borders and that goes both ways. But my main thing was because the E.U is becoming if not already a united states of Europe. The only reason countries like Poland and Romania joined was because they had no money. When my partner left Poland, she had nothing, Poland had nothing, that is why she left. Wanted to learn something and earn a living. The E.U would have us back according to Michel Barnier. https://www.euronews.com/my-eu...ator-barnier-tells-euronews Why are you so scared to say what country you are in?
    • I wonder what that line really meant...
    • draw.io Desktop 30.2.6 by Razvan Serea draw.io desktop is a downloadable security-first diagramming application that runs on Windows, MacOS and Linux. Creating diagrams in the desktop app doesn’t need an internet connection. This is useful when you are disconnected or when you must create diagrams in a highly secure environment, where data protection is of the utmost importance. When you use the draw.io desktop app, your diagrams will be stored on your local device. Because this is a stand-alone application, also designed to run offline, there are no interfaces to cloud storage platforms available. Of course, you can still store your diagrams in folders that are synchronised to your cloud storage if you wish. Easy-to-use diagram editor The draw.io apps work just like the office and drawing tools you are used to using. Drag and drop shapes from the shape libraries and drag to draw connectors between them. Drag connectors to add waypoints and set a precise shape and position, or let them reroute automatically. Double click and start typing to add a label to anything. Create tables and swimlane flows with a familiar tool. Style shapes and connectors with customisable palettes, sketch options, fonts and text formatting tools. Search for shapes, including in open-source icon libraries. Use our vast libraries of shapes and templates, organised into logical categories, to create a range of diagrams and infographics. Generate diagrams from text descriptions using our smart templates. Diagram faster with keyboard shortcuts. draw.io Desktop 30.2.6 changelog: Uses electron 42.5.0 #2452 Updates to draw.io core 30.2.6. Download: draw.io 64-bit | Standalone (Open Source) Download: draw.io 32-bit | ARM64 | ARM64 Standalone Links: draw.io Home Page | Project page @GitHub | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • One Month Later
      Excellence2025 earned a badge
      One Month Later
    • Week One Done
      Excellence2025 earned a badge
      Week One Done
    • Week One Done
      flexorcist earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • Week One Done
      Woland13 earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      498
    2. 2
      +Edouard
      208
    3. 3
      PsYcHoKiLLa
      146
    4. 4
      Steven P.
      74
    5. 5
      FloatingFatMan
      69
  • Tell a friend

    Love Neowin? Tell a friend!