MFA Fatigue: How Push Bombing Breaks the Control Everyone Trusts

The password is already gone

Every MFA fatigue attack starts the same way: the attacker already has a working username and password, harvested through phishing, credential stuffing, password reuse from an earlier breach, or infostealer logs sold on criminal markets. Those credentials clear the first authentication step but cannot satisfy the MFA challenge on their own. So the attacker does not try to break the second factor. They trigger it, over and over.

Each login attempt fires a push notification, an SMS code, or a phone call at the legitimate user. The prompts arrive in bursts, late at night, or spread through a working day. Three human factors do the attacker's work: cognitive load, which makes people error-prone under stress; habituation, the reflex to clear a notification without reading it; and training gaps, where the user cannot tell a malicious prompt from a legitimate one. Eventually the user approves one, to stop the barrage or in the mistaken belief that it is necessary, and that single tap hands over a fully authenticated session.

The Uber breach wrote the playbook

The clearest example remains the September 2022 Uber breach. A member of the Lapsus$ group obtained VPN credentials for an external contractor, then flooded the contractor's phone with MFA push requests over several hours. That single tap handed over access to Uber's internal network. MITRE ATT&CK tracks the technique as T1621, Multi-Factor Authentication Request Generation, and CISA's fact sheet calls the same thing push bombing.

What happens after the approval is fast. Attackers move to keep the foothold: a new MFA method registered, a password reset, recovery details changed, or fresh tokens minted within minutes. Some add a final push of their own, a message or call from someone claiming to be IT, explaining the prompts and asking the victim to approve one so the glitch stops. The attack needs no malware and no exploit. It needs a password and patience, which is why it featured in several of the most visible breaches of 2022.

The fix is configuration, not new technology

Number matching is the control that kills the reflexive-approval path. It shows a number on the sign-in screen and requires the user to enter it in the authenticator app, which means a prompt the user did not start cannot be approved by tapping yes. Microsoft enforced number matching in the Authenticator app by default in May 2023, and Okta, Duo, and others added similar challenges. Phishing-resistant factors like passkeys and hardware security keys remove the approval step entirely, because the private key never leaves the device.

Two operational rules sit next to the configuration. First, alert on prompt storms: repeated denials are a security signal, and a user who denies five prompts in a minute should trigger a response, not silence. Second, teach the one sentence that matters: a push prompt is not proof that you initiated a login, and you should never approve a prompt you did not start. For the attack that supplies the password in the first place, credential stuffing and why a 0.1 percent success rate is a disaster explains the math, and session replay bots covers what happens when the attacker plays back a real customer's session instead.