MFA Fatigue Attacks: Why a Flood of Login Approval Requests Is a Warning Sign

You've just sat down with your morning coffee when your phone buzzes. A login approval request, for an account you didn't try to access. You dismiss it. Then it buzzes again. And again. Annoyed and distracted, you tap "Approve" just to make the notifications stop.

Congratulations, you just handed an attacker the keys to your account.

That scenario isn't hypothetical. It's the exact playbook behind MFA fatigue attacks, one of the most effective and alarmingly simple ways cybercriminals bypass multi-factor authentication today. If you've ever received a sudden flood of unexpected login approval requests, that's not a glitch. It's a warning sign.

What is an MFA fatigue attack?

Multi-factor authentication (MFA) is supposed to be your safety net, a second layer of defense that keeps attackers out even if they've stolen your password. And for years, it worked remarkably well. Microsoft has reported that MFA blocks more than 99.9% of automated account compromise attacks.

But attackers adapt. An MFA fatigue attack (also called MFA bombing, push bombing, or prompt bombing) turns that safety net against you.

Here's the core idea: an attacker already has your username and password, likely purchased from the dark web or stolen in a prior breach. The only thing standing between them and your account is that push notification you need to approve. So instead of hacking around it, they exploit you.

They trigger login attempt after login attempt, flooding your phone with approval requests. The goal isn't to trick you with a convincing fake. It's simply to wear you down. Eventually, out of frustration, distraction, or sheer exhaustion, you tap "Allow."

The MITRE ATT&CK framework formally tracks this technique as T1621: Multi-Factor Authentication Request Generation, recognizing it as a legitimate adversarial tactic used by real threat actors.

How MFA fatigue attacks work: step by step

Understanding the anatomy of these attacks is the first step in defending against them.

Step 1: Credential theft

The attack begins long before you ever see a notification. Attackers first obtain valid login credentials. These are typically sourced from:

• Dark web marketplaces, where billions of breached credentials are bought and sold
• Phishing campaigns that trick users into entering passwords on fake login pages
• Credential stuffing, where attackers reuse passwords leaked from other breaches
• Infostealer malware that silently harvests credentials from infected devices

Step 2: Initiating the flood

With credentials in hand, the attacker initiates repeated authentication attempts against your account. Each failed login triggers a new push notification to your phone. They may use automated tools to fire these off in rapid succession, dozens of prompts in minutes.

Step 3: Social engineering (the closer)

More sophisticated attackers don't just wait. They combine push bombing with a direct social engineering call. Impersonating IT support or a company help desk, they call or message you claiming there's a "system issue" and ask you to approve the notification to resolve it. A real human voice telling you to approve dramatically increases success rates.

Step 4: Account takeover

The moment you tap "Approve," the attacker logs in as you. From there, depending on the access your account holds, they can:

• Exfiltrate sensitive data
• Move laterally across your network to higher-privilege systems
• Deploy ransomware
• Establish persistent backdoor access
• Conduct financial fraud

The entire process, from credential theft to account takeover, can happen in minutes.

Real-world examples: when MFA fatigue turned into major breaches

This isn't a theoretical threat. Some of the most high-profile cybersecurity incidents of recent years were enabled by MFA fatigue attacks.

The 2022 Uber breach

In September 2022, the hacker group Lapsus$ breached Uber through a textbook MFA fatigue attack:

1. An attacker acquired the credentials of an Uber contractor from the dark web. The contractor's personal device had been infected with infostealer malware.
2. The attacker repeatedly sent MFA push notification requests to the contractor.
3. After more than an hour of repeated notifications, the contractor approved one, allegedly after the attacker contacted them via WhatsApp while posing as Uber IT support.
4. With initial access secured, the attacker pivoted through Uber's internal systems, ultimately reaching the company's AWS environment, Google Workspace, and internal security tools.

"The Uber breach appears to be a result of an MFA fatigue attack, also referred to as an MFA bombing attack," said Duncan Greatwood, CEO of Xage Security, shortly after the incident was disclosed.

The 2022 Cisco breach

Around the same period, Cisco fell victim to a similar attack. Attackers compromised a Cisco employee's personal Google account, which contained synced corporate credentials. They then launched a sustained vishing (voice phishing) campaign combined with MFA push notifications to gain VPN access. The attackers, later attributed to the Yanluowang ransomware group, exfiltrated sensitive data from Cisco's network before being detected.

These weren't small companies with immature security programs. They had sophisticated security teams and MFA already deployed. The lesson: MFA alone isn't enough.

The warning signs: recognizing an MFA fatigue attack in progress

An unexpected MFA notification is not a minor annoyance. It's an active security alert.

Here are the key warning signs that you may be under an MFA fatigue attack:

You're receiving MFA requests you didn't initiate. This is the most critical sign. If you receive a push notification or authentication code request for a login you did not attempt, your credentials have almost certainly been compromised. Do not approve the request. Report it immediately.

You're receiving multiple requests in quick succession. One unexpected request might be a mistake. Receiving five, ten, or twenty in a short window is an attack. Automated tools allow attackers to bombard you with notifications to accelerate the fatigue process.

Requests are coming at unusual times. MFA requests arriving in the middle of the night, over the weekend, or during a vacation are a strong indicator of malicious activity. Legitimate logins follow human patterns.

Someone contacts you and asks you to approve a notification. No legitimate IT department or technology vendor will ever call you and ask you to approve an MFA notification. This combination of push bombing and social engineering is the hallmark of a sophisticated attacker.

The request shows an unfamiliar location or device. Some authenticator apps display contextual information, the location or device associated with the login attempt. If the request shows a city, country, or device you don't recognize, treat it as an active attack.

Why attackers love this method (and why it works)

MFA fatigue attacks are disturbingly effective for a few connected reasons.

They exploit human psychology, not technical vulnerabilities. There's no zero-day exploit to patch and no vulnerability scanner to catch it. The attack works because humans get tired, distracted, and flustered. Training helps, but it doesn't eliminate the underlying human factor.

Credentials are cheaply and abundantly available. Billions of username-password combinations are for sale on the dark web, often for just a few dollars per account. Attackers don't need to steal your password themselves.

Push notifications are frictionless by design. The UX convenience that makes MFA user-friendly, a single tap to approve, is exactly what attackers exploit. The lower the friction, the easier it is for a fatigued user to absentmindedly approve.

Microsoft reported over 382,000 MFA fatigue attacks recorded in a single 12-month tracking period, and found that 1% of users targeted with these attacks would eventually approve a fraudulent request. At scale, that 1% represents tens of thousands of compromised accounts.

How to protect yourself and your organization

The good news: MFA fatigue attacks are preventable. The key is moving beyond simple push-notification MFA and putting smarter authentication controls in place.

1. Enable number matching

Number matching is one of the most effective near-term countermeasures. When you attempt to log in, the authenticator app displays a number on screen. You must enter that exact number in your authentication app to approve. An attacker bombing you with push notifications won't know the number, so the flood fails. Microsoft enforced number matching by default in Microsoft Authenticator specifically in response to rising MFA fatigue attacks.

2. Add location and app context to push notifications

Configure your MFA solution to display the login location and the application being accessed in every push notification. When users can see "Login attempt from Kyiv, Ukraine, 2:47 AM" on a notification they didn't initiate, they're far less likely to approve it by mistake.

3. Adopt phishing-resistant MFA (FIDO2 / passkeys)

This is the gold standard. FIDO2-based authentication, hardware security keys like YubiKeys, or device passkeys, is cryptographically phishing-resistant and can't be defeated by MFA fatigue attacks. Because authentication is tied to a physical device using public key cryptography, there's no "approve" button to social engineer anyone into tapping. CISA has explicitly recommended phishing-resistant MFA for high-value targets.

4. Implement adaptive and risk-based authentication

Adaptive authentication evaluates contextual signals, login time, location, device, and behavior patterns, and adjusts the authentication challenge accordingly. A login attempt from a new device at an unusual hour from a foreign country should trigger additional verification or be blocked outright.

5. Set rate limits and lockouts on failed MFA attempts

Configure your authentication systems to limit the number of MFA push notifications that can be sent per minute or per session. After a threshold is crossed, automatically lock the account and alert the security team. This breaks the attacker's flood strategy at the infrastructure level.

6. Train users and audit credentials regularly

Every employee should know: an unexpected MFA request means your credentials have been compromised, not that you accidentally triggered a login. Train users to never approve a push notification they didn't initiate, to change their password immediately when they receive an unexpected prompt, and to report the incident to IT security. Pair this with regular credential audits and dark web monitoring for leaked credentials tied to your organization's domains.

The bigger picture: MFA is still essential, but it needs to evolve

It would be a mistake to read this and conclude that MFA isn't worth using. Accounts without MFA are still vastly more vulnerable than those with it. The Microsoft statistic holds: more than 99.9% of compromised accounts don't have MFA at all.

The point is that not all MFA is equal. SMS-based one-time codes, email links, and simple push notifications all carry meaningful weaknesses. The threat landscape has evolved, and your authentication strategy needs to keep up.

MFA fatigue attacks represent attackers doing what they always do, finding the path of least resistance. When technical defenses get strong, they target the human element. When simple phishing loses effectiveness, they try prompt bombing. The organizations that stay ahead treat authentication as an evolving discipline, not a checkbox.

A flood of login approval requests isn't a bug. It's a burglar rattling your door handle, over and over, waiting for the moment you open it. The technology to stop this exists. What's needed is the will to use it.

What to do if you're being targeted right now

If you're currently receiving a flood of unexpected MFA requests, here's what to do:

1. Do not approve any of them. Not even one, especially if someone is calling or messaging you asking you to.
2. Change your password immediately on the affected account from a secure, trusted device.
3. Contact your IT or security team right now. This is an active attack, not a glitch.
4. Check for unauthorized access. Review recent login history on the account for any sessions you didn't initiate.
5. Enable stronger MFA. Use this as a trigger to upgrade to number matching, hardware keys, or passkeys if you haven't already.

Conclusion

MFA fatigue attacks succeed because they exploit patience, not code. There's no patch for a tired employee tapping "Approve" at 2 a.m. Recognizing an unexpected wave of login requests for what it actually is, an active attempt to get into your account, is the first and most important step.

None of the fixes are exotic: number matching, phishing-resistant passkeys, and rate limits on push notifications all close this gap today. What most organizations are missing isn't the technology. It's the decision to make the switch before an attacker forces the issue.

Somewhere, an attacker may already have your password. The only real question is whether your MFA setup can outlast their patience.

Get a free security scan with Guardio today and stay alert to unexpected login activity.