In this post we cover MFA fatigue attacks, also known as push-bombing, so that if it happens to you or your team, you know what to do.
Multi-factor authentication (MFA) remains essential for account security, but push-bombing attacks exploit the notification approval process to get around it. Understanding how these attacks work helps your team recognize and respond calmly when targeted.
How Do MFA Fatigue Attacks Such As Push-Bombing Work?
With MFA, receiving a notification is a normal part of the login process. It’s something you are familiar with.
With push-bombing, attackers already have your password. They may get it through phishing or from a data breach password dump.
With the correct password, they target the push notification process. They attempt to log in many times in quick succession, which sends you several push notifications, one after the other.
Many people will question an unexpected prompt they didn’t request, but when someone is bombarded with them, it is easy to approve one by mistake just to make them stop.
If it happens to you: put the phone down and do not approve anything. Once the notifications stop, change your password, because it has been compromised, and tell your IT provider right away so they can check the account.
Push-bombing is a form of social engineering attack designed to:
- Confuse the user
- Wear the user down
- Trick the user into approving the MFA request to give the attacker access
For businesses, a successful push-bombing attack can lead to email compromise, data theft, and failed vendor security screenings if attackers reach administrative accounts.
How To Stop MFA Fatigue Attacks
Turn On Number Matching Or Use Passkeys
Since May 2023, Microsoft Authenticator shows a number on the login screen that the user must type into the app before approving a sign-in. An attacker sending prompts from somewhere else cannot see that number, so a tired or confused approval no longer works. Make sure every account uses the Authenticator app, not text messages.
For the strongest protection, move to phishing-resistant MFA such as passkeys or physical security keys. They only work on the real website and the user’s own device, so there is nothing to approve by accident.
Educate Your Employees
MFA fatigue attacks can be confusing and stressful. When your team knows about them beforehand, they recognize the attack and stay calm. Share this post with them, remind them never to approve a prompt they did not start, and ask them to report these attacks to your IT provider so others can be warned and the account secured.
Curate And Reduce Approved Apps
Review and reduce the number of apps approved for use across your organization. This helps in two ways:
- Fewer logins for each staff member to manage
- A chance to re-assess the security of each app
Review your productivity suite for apps and services you can access behind a single login. By maximizing your Microsoft 365 subscription or Google Workspace account, you can improve productivity and security in one move.
Create Strong Password Policies
Push-bombing only works when attackers already have a password. Strong, unique passwords for every account make that much harder. Current best practice is to:
- Use long passphrases rather than short, complex passwords
- Never reuse a password across accounts
- Store passwords in a business password manager
- Block passwords that appear in known data breaches
Adopt An Advanced Identity Management Solution
Identity management solutions can also help prevent push-bombing. They typically combine logins through single sign-on, so users have one login and one MFA prompt to manage instead of several.
They also let you set contextual login rules, such as blocking sign-ins from outside your country, from unmanaged devices, or when a sign-in looks risky. Learn more in our Identity And Access Management Guide.
Other Ways Attackers Get Around MFA
Push-bombing is not the only way attackers get past MFA. In this short video, Zoe explains how attackers also steal session tokens and cookies to walk into email accounts without ever needing a password or an MFA code.
Session Token And Cookie Theft
Instead of your password or code, the attacker steals the session token your browser uses to prove you are already signed in. It often starts with a convincing email link that leads to a fake login page sitting between you and the real one. With that token, the attacker can open your email as if they were you. See how this plays out in The Vendor Banking Email Fraud We See Every Week Now.
SIM Swapping And Help Desk Tricks
Attackers also move a victim’s phone number to their own SIM card to receive text message codes, or call a help desk pretending to be the user to get MFA reset. This is why text message codes are the weakest form of MFA, and why every MFA reset should be verified.
The protection is the same for all of these: phishing-resistant MFA, Conditional Access rules that only allow trusted devices, and regular cybersecurity awareness training.
Frequently Asked Questions
What is push-bombing?
Push-bombing, also called an MFA fatigue attack, is when an attacker who already has your password sends you login approval prompts over and over, hoping you will approve one by mistake.
What should I do if I get MFA prompts I did not request?
Do not approve any of them. Once they stop, change your password, because the attacker already has it, and tell your IT provider right away.
Does number matching stop push-bombing?
It stops most of it. With number matching, you must type the number shown on the real login screen into your authenticator app, which an attacker cannot see. Passkeys and security keys go further and remove the approval step completely.
Stronger MFA For Your Business
Phishing-resistant MFA, Conditional Access and identity management are part of the fully managed IT we provide, and part of how we help clients pass vendor security screenings. If you are looking for an IT partner who sets this up and looks after it for you, book a discovery call.
