MFA fatigue
noun · also Push bombing, MFA spamming, MFA bombing · MITRE ATT&CK T1621
An attack that floods a user with MFA push prompts, using a stolen password, until the user approves one out of confusion or annoyance.
MFA fatigue does not break multi-factor authentication. It abuses the person holding the second factor. With a valid password in hand, the attacker triggers sign-in after sign-in, each one sending a push notification to the victim's phone, and waits for one tap on "Approve". Attackers often add a call or message pretending to be IT support to speed things up.
Example
At 2 a.m., an employee's phone shows a dozen sign-in requests in a few minutes. A message arrives claiming to be from the help desk, asking them to approve the next one to "fix a sync issue". They do, and the attacker is in.
Why it matters for a SOC analyst
Repeated MFA denials for one user in a short window, followed by a success from an unfamiliar IP, is a classic pattern to hunt for. When recommending defenses, number matching, additional context in prompts, phishing-resistant MFA for high-value accounts and an easy way for users to report unexpected prompts are what make this attack fail.
Articles that use this term
Threat Analysis · · 4 min read
MFA fatigue attacks: how push bombing works and how to stop it
Why attackers flood users with MFA prompts until one gets approved, what the Uber and Cisco breaches teach us, and the controls that make push bombing fail.
Related terms
- Multi-factor authentication
Signing in with two or more different kinds of proof, such as a password plus a phone or security key, so a stolen password alone is not enough.
- Social engineering
Manipulating people, rather than systems, into giving up information, access or money by exploiting trust, urgency, authority or helpfulness.
- Phishing-resistant MFA
Authentication methods, such as passkeys, FIDO2 keys and Windows Hello for Business, that cannot be relayed or approved by a phished user.
- Conditional Access
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.
- Adversary-in-the-middle phishing
Phishing that relays the victim's sign-in to the real site through an attacker's proxy, stealing the session cookie after MFA succeeds.
- Password spray
An attack that tries a few common passwords against many accounts, staying under lockout limits that per-account guessing would trigger.