MFA Fatigue Attack
Experience an MFA push-bombing attack and learn how to defend against it.
What Is MFA Fatigue Attack?
MFA stops an attacker holding nothing but a stolen password, so attackers target the person answering the prompt instead. Late at night the push notifications start. You deny the first two, then a message from the help desk says it is routine maintenance and asks you to approve the next one. You'll work the aftermath, call the real IT team, file the report, and learn the controls that defeat this. The scenario follows the 2022 Uber breach, which ran the same way.
What You'll Learn in MFA Fatigue Attack
- Recognize an MFA fatigue (push bombing) attack from the first unexpected prompt, before the social engineering hook arrives
- Apply the rule "deny every prompt you did not initiate, no matter how many arrive" even under fatigue and time pressure
- Identify off-channel impersonation of IT (WhatsApp, Telegram, personal phone) as a hostile signal regardless of how legitimate the wording sounds
- Respond to a successful account compromise with the correct first actions - call real IT, file a thorough incident report, and notify the team about the pattern
- Choose stronger MFA controls - number matching and phishing-resistant FIDO2 / hardware keys - that defeat fatigue attacks at the protocol level
MFA Fatigue Attack — Training Steps
-
Wrapping Up for the Night
It's a few minutes past 11 PM on a Thursday. Alice has just sent the last email of the day - a routing update for tomorrow's freight schedule - and is about to shut her laptop. Her phone is on the desk beside her, charging. MFA is enabled on her work account. She sleeps better knowing it's there.
-
An Unexpected Sign-In Request
Alice's phone buzzes with an MFA push notification. Someone is trying to sign in to her Northridge Logistics Portal account. She's already signed in on her laptop. She did not initiate any new login.
-
Denying the First Prompt
This sign-in is not Alice's. The right move is to deny it immediately.
-
Another One, Right Away
Before Alice can put her phone down, a second MFA push arrives. Same account, same Sofia IP. The attempt counter on the prompt now reads Attempt #2 . Whoever has her password is not giving up.
-
A Message from "IT"
While Alice is staring at her phone wondering what's going on, a WhatsApp message arrives from someone identifying themselves as Northridge IT Help Desk . The contact is not in her phone book.
-
Reading Between the Lines
On a normal day, Alice would notice the red flags in this message. But it's after 11 PM, she's tired, and the message uses the right vocabulary - 'credential rotation', 'session re-validation', 'Help Desk'. A real attacker is counting on exactly that fatigue.
-
The Push That Decides It
Right on cue, a third MFA push arrives. Alice rationalizes: maybe IT really is doing maintenance. Approving once will end the noise so she can sleep. She taps Approve.
-
A False Sense of Quiet
The prompts stop. Alice exhales, plugs in her phone, and goes to sleep. In Sofia, the attacker is now logged in to her Northridge Logistics Portal account. They have about twenty minutes before the company's anomaly detection picks up the foreign login.
-
An Email That Doesn't Add Up
Alice settles into her home office with a coffee. Her inbox has a couple of overnight messages. The first is from David Park in Finance, and the subject line stops her cold.
-
The Pieces Start Fitting Together
Alice did not send that email. She doesn't even handle vendor banking. Her stomach drops.
Security Framework Coverage
MITRE ATT&CK
- T1621 Multi-Factor Authentication Request Generation
CIS Controls
- CIS 6 Access Control Management
- CIS 14.3 Train Workforce Members on Authentication Best Practices
NIST CSF
- PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
- PR.AA Identity Management, Authentication, and Access Control