MFA Fatigue

MFA fatigue, also called MFA push bombing or MFA push bombardment, is an attack in which repeated multi-factor authentication requests are sent to a user in hopes that the user eventually approves one.

For example, an attacker who has obtained someone’s password may repeatedly attempt to log in. Each attempt generates an authentication notification on the victim’s phone.

Eventually, the user may approve a request because they:

• Assume the request is legitimate
• Accidentally tap Approve
• Become frustrated by repeated notifications
• Believe approving it will make the prompts stop
• Are contacted by an attacker pretending to be IT support

If the user approves the attacker’s request, the attacker may gain access to the account.

What This Means for SMBs

Employees should be taught that an unexpected MFA notification is a warning sign.

If a user receives authentication requests they did not initiate, they should deny the request and report it rather than simply dismissing it.

Organizations should also move toward authentication methods that are more resistant to this type of attack.

CISA recommends phishing-resistant FIDO/WebAuthn authentication when possible. When that is not yet available, stronger push methods such as number matching can provide additional protection compared with simple Approve/Deny notifications.

What This Means for MSPs

MSPs should review the MFA methods deployed across client environments.

Clients relying on simple push approvals should be encouraged to move toward stronger authentication, particularly for administrators, remote access, email, financial applications, and other high-value systems.

Repeated MFA requests should also be treated as a potential security incident rather than merely a user inconvenience.

MSP employees themselves require especially strong authentication because their accounts may provide privileged access to multiple customers.

Practical Takeaway

Never approve an MFA request you did not initiate.

Repeated authentication prompts can indicate that an attacker already has part of the information needed to access your account.

---

Additional Reading:

CyberHoot does have some other resources available for your use. Below are links to all of our resources, feel free to check them out whenever you like:

• Blog
• Cybrary (Cyber Library)
• Infographics
• Newsletters
• Press Releases
• Instructional Articles (HowTo) – very helpful for our Super Admins!

---

Secure your business with CyberHoot today!