Microsoft Entra ID: Has anyone seen suspicious AMC PROD sign-ins with MFA (SMS) and unexpected WhatsApp OTPs?

We were looking into a unique case of authentication in Microsoft Entra ID and we wanted to know if others had a similar experience.

Over the past few days, the following was noticed,

• More than 15 user accounts accessing a new application called AMC PROD.
• Sign-ins from countries that seem geographically or logistically inconsistent.
• Multi-factor authentication is satisfied in all these authentication cases.
• On the sign-in logs of Microsoft Entra ID, all these authentication techniques were logged as SMS Sign-In.
• A few affected users have confirmed that they did not access the application during these intervals.
• Same Application ID used in all these affected cases.

One thing that seems really odd about this particular application is that it does not exist in our Enterprise Applications nor does it exist in our App Registrations. We did not even create/register this application deliberately.

It is noteworthy that some of the impacted users have started receiving Microsoft verification codes sent via WhatsApp by the sender name "ROCKSENDER" despite not doing anything to start the sign-in process or the request of an OTP code.

We would like to know if,

• Has anybody come across AMC PROD in Microsoft Entra ID sign-ins?
• Is AMC PROD an application managed by Microsoft or related to a Microsoft service?
• Why does the method of all authentications show up as "SMS Sign-in" in Entra ID while users are receiving the OTP through WhatsApp?
• Is the ROCKSENDER sender name used by Microsoft as a channel for sending MFA codes?
• Has anybody received unsolicited Microsoft OTPs through WhatsApp despite not initiating the sign-in process?
• Could this mean there is a compromised token/session, AiTM phishing, or any other authentication issue?

I am appreciate it if anyone has experienced the same issue or can recommend further logs of Entra ID to check out.