Multi-factor authentication (MFA) has long been one of the strongest defenses against credential theft, but attackers have adapted their tactics. Rather than breaking MFA, they exploit the people using it through a technique known as MFA fatigue or push bombing.
This guide explains how these attacks work, why they have become a preferred method for threat actors, the real-world breaches they have enabled, and the practical steps organizations can take to prevent them.
What Is MFA Fatigue (Push Bombing)?
MFA fatigue, also called push bombing or MFA bombing, is a social engineering attack in which an adversary who already holds valid credentials sends repeated multi-factor authentication requests to a victim’s device. The goal is to wear the person down until they approve one out of confusion or irritation, handing over account access without breaking any cryptography.
Multi-factor authentication was meant to close the gap that passwords left open, and for a while it did. Then attackers found a way around it that requires no malware and no exploit code, only patience and a phone that will not stop buzzing. That technique has become one of the most reliable ways to break into an enterprise account that is otherwise well protected.
This matters because push bombing does not target a flaw in the technology. It targets the person holding the device. A control that depends on a tired employee tapping “approve” at eleven at night is a control with a very human weak point, and threat actors have built entire playbooks around exploiting it.
Why Do Attackers Choose Push Bombing Over Other MFA Bypass Methods?
Credential theft alone rarely gets an attacker past a properly configured MFA policy. Push bombing gives them a way to finish the job using stolen credentials that would otherwise be useless. It requires no custom malware, no zero-day, and very little technical skill beyond scripting repeated login attempts.
It also scales well against large organizations, where a single approval from one employee can open the door to VPNs, cloud consoles, and internal collaboration tools. This is why identity has become the primary target for modern intrusions, and why treating identity as the new security perimeter has become a foundational principle rather than an optional upgrade. Organizations built on Zero Trust security start from the assumption that any single approval, even a legitimate looking one, cannot be trusted without additional context.
How Does Push Bombing Work?
The pattern is consistent across most documented incidents, and it plays out in a predictable sequence.
The push bombing attack chain:
- Credential Theft: The attacker acquires a valid username and password through phishing, credential stuffing, or a dark web purchase.
- Repeated Login Attempts: The attacker uses those credentials to trigger the login process repeatedly, each attempt generating a fresh MFA request.
- Push Notification Flood: The victim’s device receives a rapid series of approval prompts, SMS codes, or phone calls, often late at night or during a busy workday.
- Social Pressure (Optional): In many cases, the attacker contacts the victim directly, posing as internal IT support and asking them to approve one more prompt to make the alerts stop.
- Fatigue-driven Approval: Worn down by the volume of requests, the victim taps approve, believing it will end the disruption or resolve what looks like a system glitch.
- Account Takeover: The attacker gains full access and can move laterally, register new authentication devices, or reset recovery settings to lock the legitimate user out.
This flow works well as a one-page visual for security awareness training or an internal runbook.
Who Is Most at Risk From Push Bombing Attacks?
Any organization using push-based MFA is exposed, but certain groups carry higher risk. Employees with privileged access, IT help desk staff, and contractors with standing remote access are frequent targets because their accounts unlock the most valuable systems. External contractors and third-party vendors deserve particular attention, since their credentials are often less tightly monitored than those of full-time staff, which is exactly the gap that a strong third-party risk management program is designed to close.
Remote and hybrid workforces add further exposure, since employees checking a phone prompt outside normal working hours are less likely to pause and question it.
What Real-World Breaches Were Caused by MFA Fatigue?
The 2022 breach of Uber is the case most often cited. An attacker purchased an external contractor’s credentials, bombarded them with MFA push requests for an extended period, and then contacted the contractor over WhatsApp posing as IT support. The contractor approved a request to stop the notifications, granting the attacker access to internal systems including Slack and Google Workspace.
Threat groups such as Scattered Spider have built entire campaigns around this technique, targeting help desks and using it alongside SIM swapping and vishing to compromise large enterprises across telecommunications, hospitality, and financial services. The consequences frequently extend beyond initial access, with these intrusions serving as a launch point for data theft and ransomware deployment through the growing ransomware-as-a-service ecosystem.
Key Indicators of Compromise
A single denied push notification is not necessarily an incident but a pattern. Security teams should treat the following as clear indicators of an active MFA fatigue attempt:
- Multiple push requests within a short window for the same account.
- Requests originating from unfamiliar IP addresses or geolocations.
- Login attempts that do not correspond to any action the user initiated.
- A spike in denied prompts followed by a single approval.
- A new MFA device registered, a password reset, or recovery settings changed shortly after an approval.
That last group of signals is often the clearest sign that an attack succeeded and should trigger immediate investigation. Continuous monitoring for these indicators is a core identity threat detection and response, which extends traditional IAM with real-time behavioral analytics built for exactly this kind of anomaly.
Push MFA vs. Number Matching vs. FIDO2: Which Stops Push Bombing?
Not every form of MFA offers the same level of protection. The table below compares the three most common approaches enterprises evaluate when hardening authentication against push bombing.
| Method | How It Works | Resistance to Push Bombing | Resistance to Phishing | Best Fit |
| Standard Push MFA | Single tap to approve or deny a login request | Low | Low | Legacy deployments only; should be phased out |
| Number Matching | User must enter a code displayed on the login screen into the app | Moderate to High | Moderate | Minimum baseline for any push-based MFA in use today |
| FIDO2 / Passkeys | Cryptographic key bound to the device and the specific domain being accessed | Very High | Very High | Privileged accounts, admins, and high-risk enterprise access |
Number matching closes much of the gap left by simple push approval, since it forces the user to look at context before confirming. FIDO2 security keys and passkeys go further, because they are not vulnerable to push bombing at all. There is nothing to approve blindly, since the cryptographic exchange only completes on the legitimate site the user is trying to reach.
How Can Organizations Prevent and Detect MFA Fatigue Attacks?
The most effective fix is moving away from simple push approval toward methods that require the user to confirm context, not just tap a button, as outlined in the comparison above. Rate limiting and automatic lockout after a defined number of failed or denied requests prevent attackers from sending unlimited prompts in the first place.
Enforcing least-privilege access limits what a single compromised approval can reach, so a help desk credential does not carry the same blast radius as a domain administrator account. Continuous monitoring within a well-run security operations function is equally important, since catching the pattern of repeated requests before an approval land is often the difference between a blocked attempt and a full breach. Building this kind of detection and response capability is one of the core functions of a modern security operations center.
User education still matters. Employees should be trained to treat any unexpected MFA prompt as suspicious, deny it, and report it immediately rather than assuming it is a glitch. None of these controls work in isolation. They need to sit within a broader identity governance strategy that manages provisioning, enforces least privilege, and monitors behavior across every account, human or automated.
Building MFA Resilience Into Your Identity Strategy
MFA fatigue succeeds because it targets human decision-making under pressure, not a technical flaw in authentication protocols. Organizations that pair phishing-resistant MFA with strong identity governance and active monitoring remove the conditions the attack depends on. Ampcus Cyber helps enterprises design and operate identity and access management programs that close these gaps before attackers can exploit them.
| Talk to our identity security team to assess how exposed your organization is to push bombing and other MFA bypass techniques. |
Enjoyed reading this blog? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
