MFA Fatigue: Approving the Attacker by Accident

MFA fatigue — also called push bombing or MFA bombing — exploits the weakest form of multi-factor authentication: the simple “Approve / Deny” push notification. An attacker who already holds valid credentials repeatedly triggers login attempts, flooding the victim’s phone with approval prompts until, out of annoyance, confusion or a belief the prompts are a glitch, the user taps Approve. The technique needs no malware and no proxy — just stolen credentials and persistence. It featured in the September 2022 Uber breach and is a staple of groups such as Lapsus$ and Scattered Spider.

How It Works

The attacker first obtains valid credentials (through earlier phishing, infostealer logs or password reuse). They then submit repeated authentication attempts, each of which sends a push-approval prompt to the legitimate user’s device. The attack often pairs the spam with social engineering — a message or call impersonating IT, telling the user to “approve the prompt to stop the alerts.” A single approval grants the session. T1621 T1078

MITRE ATT&CK Mapping

Detection & Mitigation

• Turn on number matching (and additional context such as app/location) so a prompt cannot be approved with a single tap — the user must enter a number shown on the sign-in screen, which the attacker does not have.
• Prefer phishing-resistant MFA (FIDO2/passkeys), which has no approve-prompt to bomb; limit the number of push attempts and lock or alert after repeated denials.
• Alert on bursts of failed/denied MFA for one account, and on approvals from unusual locations; treat a flood of prompts as an incident, not a nuisance.
• Educate users to deny and report unexpected prompts, and build a trusted channel to verify “IT” requests so social-engineering reinforcement fails.