What Is an MFA Fatigue Attack, and How Does It Work?

An MFA fatigue attack — also called push bombing or MFA bombing — is when a hacker who already has your stolen password tries to log in over and over, flooding your phone with multi-factor authentication approval requests until you tap "approve" by accident, out of annoyance, or because you're tricked into thinking it's legitimate. It doesn't break the cryptography behind multi-factor authentication (MFA); it exploits the human on the other end of the push notification. The technique has been tied to some of the highest-profile corporate breaches of the past few years, including intrusions at Uber, Cisco, and MGM Resorts, and it's a major reason regulators now push companies toward "number matching" and phishing-resistant login methods instead of simple tap-to-approve prompts.

How push-based MFA is supposed to work

Most workplace accounts protected by multi-factor authentication use an authenticator app — Microsoft Authenticator, Duo, Okta Verify, and similar apps are common examples. The intended login flow has three steps, as described by the Cybersecurity and Infrastructure Security Agency (CISA) in its guidance on implementing number matching in MFA applications: a user enters a username and password; the identity platform sends a signal to the authenticator app on the user's phone, which generates a "push" notification; and the user opens that notification and taps "approve" to finish logging in.

That design is a real improvement over a password alone, because a stolen password isn't enough to get in — the attacker also needs access to the approval prompt on the account owner's phone. The weak point is what happens when an attacker already has the password and simply starts generating prompts.

How an MFA fatigue attack actually works

Once an attacker has a valid username and password — bought from a criminal marketplace, harvested through a phishing page, or lifted from malware on a personal device — they can enter those credentials into the company's login page repeatedly. Each attempt triggers a fresh push notification on the real employee's phone, even though the employee never typed anything. CISA describes the core mechanic bluntly: a threat actor "bombards a user with mobile application push notifications until the user either approves the request by accident or out of annoyance with the nonstop notifications."

In practice, two things tend to happen alongside the flood of prompts:

First, sheer volume wears people down. Getting one unexpected login prompt at 11 p.m. is alarming; getting forty of them in a row, especially during a workday when approving prompts is a normal habit, makes it easy to tap "approve" just to make the buzzing stop. Microsoft's own research, published by Identity Security director Alex Weinert, found that roughly 1% of users will accept a simple, context-free approval request on the first try — a small percentage that becomes a real risk once an attacker can generate dozens of attempts against one person, or run the same technique against thousands of employees at once.

Second, attackers often pair the prompt flood with direct social engineering, contacting the target by phone, text, or workplace chat and posing as IT support or a help desk technician. The message is simple: "We're seeing a security alert on your account — please approve the verification request so we can fix it." A single well-timed phone call can do more than fifty automated prompts, because it gives the target a plausible, human reason to tap "approve" instead of the normal reason to be suspicious. This is social engineering aimed at a login system, not a technical exploit — the kind of trust-based manipulation covered in our explainer on SQL injection works the opposite way, by attacking flawed code rather than a flawed decision.

Case study: the 2022 Uber breach

In September 2022, Uber disclosed that an attacker had compromised an external contractor's account and used it to reach internal company systems, including internal tools, its cloud infrastructure dashboards, and a company Slack workspace. According to Uber's own account, published on its newsroom security update, the attacker likely purchased the contractor's corporate password after it was exposed by malware on a personal device. From there, the attacker repeatedly attempted to log in, and each attempt sent the contractor a two-factor login approval request. The contractor initially declined the flood of requests but eventually accepted one, which let the attacker in.

Uber said it found no evidence that the attacker accessed production systems, changed any code, or reached sensitive user account data, and its public-facing apps kept running throughout. The company said it believed the intruder was affiliated with the Lapsus$ hacking group and that it was working with the FBI and the U.S. Department of Justice. In response, Uber re-authenticated employees before restoring access to internal tools and said it was "further strengthening" its MFA policies. The initial point of failure — a contractor's personal device compromised by malware, which exposed a password an attacker could reuse — is a reminder that the kind of hidden spyware infections that quietly harvest saved credentials can undermine account security long before any push notification is ever sent.

Case study: the 2022 Cisco breach

Roughly four months earlier, in May 2022, Cisco suffered a similar intrusion, which its Cisco Talos threat intelligence team detailed in a public write-up after the Yanluowang ransomware group claimed credit for it. Per Talos's account, the attacker first took over an employee's personal Google account, where that employee's browser had synced saved Cisco credentials. With that stolen password in hand, the attacker spent several days placing voice-phishing calls, posing as trusted IT and support organizations, while simultaneously triggering repeated MFA push requests — a direct combination of social engineering and MFA fatigue. The employee eventually accepted one of the prompts, giving the attacker VPN access under the employee's identity; Talos also reported that the attacker went on to enroll additional MFA devices of their own on the compromised account.

From there, Talos documented escalation to administrative privileges, movement into Cisco's Citrix environment, and access to domain controllers, including credential-dumping activity. Cisco said the intrusion did not result in theft of sensitive data or have a discernible business impact, and Talos found no evidence the attacker reached product development, source code, or signing systems — the confirmed exfiltration was limited to the contents of one employee's Box folder, described as non-sensitive, plus Active Directory authentication data. Talos attributed the attack, with moderate-to-high confidence, to an initial access broker it assessed has ties to the UNC2447, Lapsus$, and Yanluowang groups.

Case study: the 2023 MGM Resorts breach

MGM Resorts International disclosed "a cybersecurity issue" affecting its U.S. systems in a filing with the U.S. Securities and Exchange Commission on September 13, 2023, after the company shut down a range of hotel and casino systems in response. A follow-up SEC filing on October 5, 2023 put a preliminary number on the damage: MGM estimated roughly $100 million in negative impact to its Las Vegas Strip and regional operating results, plus under $10 million in one-time response costs, and said attackers had obtained personal information — including names, contact details, and, for a limited number of customers, Social Security and passport numbers — belonging to guests who had transacted with MGM before March 2019. MGM said it did not believe customer passwords, bank account numbers, or payment card data were exposed.

Neither filing names an attacker or describes the technical entry point — that level of detail isn't typically what an SEC disclosure covers. The attack has widely been linked to the financially motivated group tracked as Scattered Spider, whose tactics are the subject of a joint advisory from CISA and the FBI. That advisory describes a pattern that goes a step beyond classic push bombing: the group researches an employee's role and personal details from social media and data leaks, then calls or texts a company's IT help desk while impersonating that employee, talking staff into resetting a password or re-registering MFA onto a device the attackers control. The same advisory also lists conventional MFA fatigue — "sending repeated MFA push notifications until a user accepts" — and SIM-swapping as tools in the group's kit. The common thread across Uber, Cisco, and the Scattered Spider playbook is the same: MFA is only as strong as the human process around approving it.

Why plain push notifications are the weak link

Push-based MFA became popular because it's easy: no codes to copy, no hardware to carry, just a tap. That convenience is exactly the problem. A bare "approve/deny" prompt gives the user no information about who is actually asking — not the location of the request, not the application being accessed, not even confirmation that it was triggered by their own login attempt a moment earlier. CISA's guidance flags this directly, noting that a threat actor who has a stolen password can "generate hundreds of prompts on the user's device over a short period of time," and that denied prompts are themselves a signal worth investigating, since a login prompt only fires after a correct password has already been entered.

How different MFA methods hold up against fatigue attacks

How to protect yourself and your organization

Frequently asked questions

Is an MFA fatigue attack the same as phishing? Not exactly, but the two overlap heavily in practice. MFA fatigue is a social-engineering technique that targets the approval step of multi-factor authentication specifically; attackers frequently combine it with phishing (to steal the initial password) and with vishing-style phone calls impersonating IT support to get a prompt approved faster.

Can MFA fatigue attacks happen over text message or phone calls, not just app notifications? Yes. While "push bombing" most often refers to flooding an authenticator app, attackers documented in the Cisco and Scattered Spider cases paired prompt floods or MFA resets with direct phone calls impersonating support staff — the technology is only half the attack.

What's next: number matching and passkeys

The industry's near-term fix for MFA fatigue is number matching, which both CISA and Microsoft now treat as close to a baseline requirement for any organization still using bare push notifications: the login screen displays a number, and the user has to type that same number into the authenticator app to approve the request. Microsoft's own data, drawn from live customer environments, found that turning on number matching together with added context — showing the requesting app and approximate location — eliminated the MFA fatigue attacks it was tracking. It isn't a perfect fix; a user can still be talked through typing the right number into a fake prompt during a live phone-based social-engineering attempt, which is why CISA calls it "one of the best interim mitigations" rather than a permanent solution.

The stronger, longer-term fix is to remove the tap-to-approve step altogether. Hardware security keys and passkeys authenticate using cryptography tied to the real website's domain, so there's no push notification to flood and no shared code that a caller can talk someone into reading aloud. Our comparison of passkeys versus authenticator apps breaks down how that shift works for everyday logins, not just corporate ones — and it's the same direction CISA, Microsoft, and most major identity providers are now pushing both businesses and individual users toward.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage