MFA fatigue

MFA fatigue, also called push bombing, defeats multi-factor authentication by exhausting the person rather than breaking the technology. Holding a valid password, the attacker triggers approval prompts repeatedly until the target approves one to stop the interruption, or is persuaded to approve by someone posing as IT.

This library records 3 cases. All involve organisations that had MFA correctly deployed.

How the attack runs

1. A valid password is obtained first, typically bought from an infostealer market or harvested earlier.
2. Repeated authentication attempts generate a stream of push notifications to the legitimate user.
3. Ambiguity does the work. The prompts are genuine, from the real application, so nothing looks like an attack.
4. Optional human reinforcement. The attacker contacts the target posing as internal IT and asks them to approve to “clear the error”.
5. One approval is enough, after which the session is established.

Documented cases

• Uber (2022): an affiliate bought a contractor’s stolen password, flooded them with prompts, then posed as Uber IT to get one approved.
• MGM Resorts (2023, about $100M): help-desk manipulation used to reset authentication rather than defeat the prompt.
• Caesars Entertainment (2023, about $15M): the same operating pattern reached through an outsourced provider.

How it differs from related techniques

Credential harvesting supplies the password this attack depends on. Help-desk manipulation attacks the reset path instead of the prompt. Account takeover is the outcome. Push bombing is specifically the exhaustion technique.

The control that would have stopped it

• Number matching or challenge-response instead of simple approve or deny. A prompt that requires typing a displayed value cannot be approved reflexively.
• Phishing-resistant MFA bound to the origin, which removes the approvable prompt altogether.
• Rate limiting and lockout after repeated failed attempts, plus alerting on the pattern. A burst of prompts is itself a high-confidence signal.
• Train the specific script. Staff should know that IT will never ask them to approve a prompt, and that a flood of prompts means a password is already compromised and must be reported.
• Extend all of this to contractors. Uber began at a contractor account.