MFA fatigue

MFA fatigue is a social-engineering attack that floods a user with multi-factor login prompts until they approve one, letting an attacker who already holds the password sign in.

It is also called push bombing, MFA bombing, or prompt bombing. The prompts are genuine and come from the real sign-in service, so the attack works on the person, not on a flaw in the software. Attackers often add a message or call from fake IT support to explain the prompts away.

How does an MFA fatigue attack work?

The chain below follows Uber’s own security update on its September 2022 breach. Each step carries the stage name used across this library.

1. Credential theft: the attacker obtains a valid username and password. Uber says the contractor’s corporate password was likely bought on the dark web after malware infected the contractor’s personal device. See credential harvesting.
2. Initial contact: the attacker signs in again and again. Each attempt sends a real approval request to the real user’s phone, and Uber says these requests initially blocked access.
3. Pretext: the attacker reaches the target while posing as IT support and presents approval as the way to stop the alerts. The FBI and CISA advisory on Scattered Spider (November 2023) lists both moves: posing as IT staff and sending repeated prompts.
4. Access: one approval is enough. In Uber’s words, “Eventually, however, the contractor accepted one, and the attacker successfully logged in.”
5. Escalation: the first account opens others. At Uber, the attacker reached several employee accounts and gained elevated permissions to tools including G-Suite and Slack.

Example: those five steps took the Uber attacker from a stolen contractor password to a message posted in a company-wide Slack channel. In 2023, UK prosecutors told Southwark Crown Court that the intrusion caused nearly $3 million of damage to Uber, as recorded in the Uber case.

Which real attacks used MFA fatigue?

Two cases in this library document push bombing directly. Both are linked to LAPSUS$, the group Microsoft tracks as DEV-0537.

Uber, September 2022: a contractor approves one prompt

An attacker Uber believes is affiliated with LAPSUS$ used a contractor’s stolen password, triggered repeated two-factor approval requests, and got one accepted. Uber said it had not seen access to the production systems behind its apps or to its sensitive user databases. Status: Documented incident. Read the Uber MFA fatigue breach case.

Microsoft, March 2022: push bombing as one tool among several

Microsoft’s March 22, 2022 threat report says DEV-0537 satisfied MFA in two main ways: replaying stolen session tokens, and using stolen passwords to trigger simple-approval prompts until the user consented. Microsoft confirmed that a single compromised account gave the group “limited access” but did not say which method reached it. Status: Documented incident. Read the Microsoft LAPSUS$ intrusion case.

Five ways attackers got past MFA in this library

Push bombing is one of several routes around a second factor. The table compares the routes documented in seven cases from this library.

Route	Case in this library	Control that breaks it
Push-prompt flood: repeated sign-ins until the user approves	Uber (2022); Microsoft (2022)	Number matching; phishing-resistant MFA
Help-desk reset: a caller posing as the employee gets MFA reset	MGM (2023, reported); Caesars (2023, reported); Clorox (2023, alleged)	Out-of-band identity check before any reset
Replacement token by chat: a new MFA token requested from a hijacked Slack session	EA (2021)	The same identity checks for chat and phone
Code read out on a call: a fake IT caller gets a one-time code	Retool (2023)	Phishing-resistant MFA, which leaves no code to share
Real-time code relay: a phishing kit forwards codes before they expire	0ktapus (2022)	Phishing-resistant MFA bound to the real site

Example: Clorox alleges in its lawsuit that Cognizant’s help desk reset an impersonated employee’s MFA on request, including the phone number tied to SMS codes. No prompt flood was needed.

What does push bombing look like to the person targeted?

• Approval requests you did not start. At Uber, each of the attacker’s sign-in attempts sent the contractor a request.
• Requests that keep coming after you deny them. Uber says the first requests blocked access, and the attacker kept trying.
• A message or call from “IT” soon after the prompts, telling you to approve. The Uber case record describes the attacker posing as tech support at this step.
• For help-desk staff, a caller who wants MFA reset and proves identity only with facts anyone could find. Microsoft saw DEV-0537 answer recovery questions such as “mother’s maiden name” to convince help desks.

Tip: a flood of prompts means your password is already known. Deny every prompt, report it, and change the password.

How do you stop it at each stage?

Stage	Control	What it would have broken
Credential theft	Reset any password exposed by malware or a breach; keep work logins off unmanaged devices	The password Uber’s attacker likely bought
Prompt flood	Cap prompts per account, block sign-in after repeated denials, and alert on bursts	The repeated requests sent to the Uber contractor
Pretext	Tell staff and contractors that IT will never ask them to approve a prompt	The fake tech-support contact at Uber
Approval	Number matching; better still, phishing-resistant MFA (FIDO2/WebAuthn or PKI)	The single approval that let the Uber attacker in
Persistence	Alert on every new MFA device registration	Scattered Spider registering its own MFA tokens, per the FBI and CISA

Example: Microsoft’s 2022 guidance on DEV-0537 told organizations to avoid simple push, SMS, and voice approvals and to use FIDO tokens or an authenticator app with number matching.

When the approval is bought, not worn down

Fatigue is one way to get a yes. Microsoft’s DEV-0537 report describes a cheaper one: the group paid employees, suppliers, or business partners for their credentials and for approving MFA prompts. A recruited insider approves on the first try, so prompt limits and burst alerts never fire.

The same report notes that many organizations outsource their help desks, and that DEV-0537 called help desks to reset privileged accounts. Uber’s breach also began at a contractor account. Controls that cover only direct employees leave both gaps open.

Example: Microsoft advised reviewing help-desk reset policies for highly privileged users and executives with social engineering in mind.

How is MFA fatigue different from a help-desk MFA reset?

MFA fatigue targets the user’s phone: the attacker leaves the existing factor in place and wears the owner down until they approve. A help-desk MFA reset targets the support process: the attacker persuades an agent to remove or replace the factor, so no prompt reaches the real user at all. MFA code phishing sits between the two, because the user types or reads out a one-time code instead of tapping approve. All three usually end in account takeover. The help-desk route is the one reported in the MGM help-desk vishing case. For a prevention checklist, see how to prevent MFA fatigue.

Push bombing: common questions

Is MFA fatigue the same as push bombing?

Yes. MFA fatigue, push bombing, MFA bombing, and prompt bombing all name the same technique: repeated sign-in attempts that send approval prompts until the user gives in. The FBI and CISA map it to MITRE ATT&CK technique T1621, Multi-Factor Authentication Request Generation, in their November 2023 advisory on Scattered Spider. Security teams can use that ID to find detection guidance.

What should I do if I get MFA prompts I did not request?

Deny every prompt and never approve one just to make them stop. Report the prompts to your security or IT team straight away, then change the password, because an unexpected prompt means someone already has it. If anyone contacts you claiming to be IT and asks you to approve, end the contact and call IT back on a number you already know.

Does number matching stop MFA fatigue?

Number matching blocks blind approvals, because the user must type a number shown on the sign-in screen the attacker is using. It does not stop a caller who talks the user into typing that number. Microsoft recommended number matching against DEV-0537 in 2022. The FBI and CISA’s 2023 advisory goes further and points to FIDO/WebAuthn or PKI-based MFA, which it describes as not susceptible to push bombing.

Was the MGM hack an MFA fatigue attack?

No. The reported route into MGM Resorts in September 2023 was a call to the IT help desk that got an employee’s access reset, not a flood of prompts. The FBI and CISA list push bombing among Scattered Spider’s general techniques, which is one reason the two get confused. MGM’s own SEC filings do not describe the method at all. See the MGM case for what is confirmed.

Are one-time codes safer than push prompts?

Codes cannot be approved with a single tap, but this library shows them failing in other ways. At Retool in 2023, a caller posing as IT got an employee to share an extra code. In the 2022 0ktapus campaign, a phishing kit captured 5,441 codes and relayed them to attackers in real time. Only phishing-resistant methods, such as FIDO2 security keys, leave nothing to hand over.

Reviewed by SEE Team. Last reviewed 21 Oct 2026. Every case on this page links to its sourced record. See the methodology and about SEE.