Microsoft Authentication Broker Sign-in from Attacker IP 162.35.167.138

Duo Tech@duotech

•updated Jul 9, 2026•6•0•13

Detects a sequence of authentication events from a specific IP address associated with the Microsoft Authentication Broker app, where an initial MFA challenge (ResultType 50199 - MFA challenge) is followed by a successful authentication (ResultType 0). This pattern is indicative of MFA fatigue attacks where an adversary repeatedly prompts a user until they inadvertently approve the request.