Social Engineering & FraudMANIPULATIVE

MFA Fatigue Attack

What it is

An account takeover in which an attacker who already has a password floods the victim with repeated multi-factor push notifications, wearing them down or confusing them into approving one.

How it works

Push-based multi-factor authentication asks the user to tap "approve" on their phone, a design that trades security for convenience and assumes prompts are rare and meaningful. The MFA fatigue attack (also called push bombing) breaks that assumption: holding a stolen password, the attacker triggers login attempt after login attempt, sending a stream of approval prompts. The victim faces a barrage of notifications, often at night, and eventually taps approve to make them stop, or assumes a glitch, or is nudged by a follow-up message posing as IT. The lever is a mix of annoyance, habituation to clicking, and the plausibility of a technical error. Uber's September 2022 breach is the reference case: an attacker used a contractor's stolen credentials, flooded them with prompts, then messaged them on WhatsApp posing as Uber IT saying to approve, and the contractor did, opening the internal network. The countermeasure is well established: number-matching MFA, which requires the user to type a code shown on the login screen, defeats blind approval, as CISA recommends.

Real-world examples

•In September 2022 a Lapsus$ actor used an Uber contractor's stolen password, bombarded them with MFA prompts for hours, then posed as IT on WhatsApp telling them to approve; the contractor complied and the attacker reached internal systems.
•The same group used push-bombing against other technology firms in 2022, pairing credential theft with relentless approval requests.
•A user asleep at night wakes to a dozen "approve sign-in?" alerts and taps approve to silence the phone, unknowingly admitting the attacker.
•Attackers sometimes send a single well-timed prompt right after impersonating the help desk, so the victim expects and approves it.

Historical case studies

The 2022 Uber breach

2022Corporate Security

In September 2022 an attacker obtained an Uber contractor's password, probably bought after malware infected the contractor's personal device, and then repeatedly triggered two-factor login approval requests to the contractor's phone. The contractor eventually accepted one. From that account the attacker reached internal tools including the company's Slack and posted a message announcing the breach to staff. Uber attributed the intrusion to the Lapsus$ group. The second factor worked as designed; what gave way was a person receiving prompt after prompt.

Source →

The Cyber Safety Review Board report on Lapsus$

2023Government Review

The US Cyber Safety Review Board examined a run of intrusions into major technology companies by Lapsus$, a loosely organized group that included teenagers. It found the group relied on inexpensive, well-known techniques rather than sophisticated tools: SIM swapping, bribing or tricking telecom and help-desk staff, and bombarding employees with authentication prompts until one was approved. The Board concluded that SMS and voice-call codes and simple approve-or-deny push prompts were inadequate for most organizations and urged a move to phishing-resistant, passwordless authentication.

Source →

Ethical guidelines

●Spamming approval prompts to bypass another person's MFA is unauthorized access and fraud; there is no legitimate use.
●Organizations that deploy tap-to-approve MFA owe users a more resistant configuration once push bombing is known, rather than blaming the tricked employee.
●Any accompanying "IT" contact urging approval is impersonation and compounds the offense.

How to defend against it

►Never approve a login prompt you did not personally initiate; unexpected prompts mean someone already has your password, so treat them as an alarm and change it.
►Push for number-matching MFA, which makes you type a code shown on the real login screen, so blind "approve" taps cannot admit an attacker.
►Prefer phishing-resistant factors (passkeys or hardware security keys) for critical accounts, which are immune to prompt flooding.
►Report a burst of unexpected prompts to your IT team immediately, and do not trust a follow-up call or message telling you to approve; real IT will not ask that.
►Rate-limit and alert on repeated MFA prompts at the organization level so a flood is detected rather than endured.

From the Defense Playbook

Multi-Factor Authentication and Passkeysminutes

Turn on a second factor for every account that matters and prefer phishing-resistant forms (passkeys or hardware security keys), so that a password typed into a fake page or talked out of you on the phone is not enough to take the account.

Every playbook entry states how strong its evidence is and when not to use it. Browse the full playbook.

References

Uber Technologies (2022). Security update. Uber Newsroom · link
Company account of the September 2022 breach beginning with a contractor approving MFA prompts after push bombing and fake-IT contact.
Cybersecurity and Infrastructure Security Agency (CISA) (2022). Implementing Number Matching in MFA Applications. CISA · link
Recommendation of number-matching MFA to defeat push-bombing and blind-approval attacks.
Doerfler, P., Thomas, K., Marincenko, M., Ranieri, J., Jiang, Y., Moscicki, A., & McCoy, D. (2019). Evaluating Login Challenges as a Defense Against Account Takeover. Proceedings of the 2019 World Wide Web Conference (WWW 2019) · link
Evidence that phishing-resistant factors outperform prompt-based challenges against targeted takeover.

Last reviewed 2026-09-07

Suggest a correction

Detect MFA Fatigue Attack in any text

Paste any message, email, or article into our free Manipulation Detector to see if MFA Fatigue Attack or other techniques are being used on you.

Try the Detector Free Create Free Account

Social Engineering: Why Smart People Fall for It

Social engineering does not target stupidity. It targets helpfulness, deference, and time pressure, which are the same habits that make people good at their jobs. Here is how the attacks are built and which procedures actually stop them.

7 min read

The Disinformation Playbook: How Campaigns Are Built and Where They Break

Disinformation campaigns follow a recognizable sequence: seed, launder, amplify, and let real people carry it the rest of the way. A field guide to the stages, drawn from the research, with the defences that work at each one.

8 min read