Attack Guide
MFA Fatigue Attacks: How Push Bombing Bypasses 2FA
Answer: An MFA fatigue attack (also called push bombing or MFA bombing) is when an attacker who already has your password floods your phone with authentication approval prompts, betting you will approve one by accident or frustration. It turned the 2022 Uber breach into a full compromise and remains a common route to account takeover.
How does an MFA fatigue attack work?
- The attacker obtains your username and password — through phishing, a data breach, credential stuffing, or infostealer malware.
- They attempt to log in to your account repeatedly, triggering MFA push notifications to your phone each time.
- You receive dozens of approval prompts in rapid succession — often late at night or during busy moments.
- The attacker may follow up with a phone call or message impersonating IT support, urging you to "just approve it."
- If you approve even one prompt, the attacker gains access to your session — bypassing the very MFA that was meant to protect you.
- Once inside, the attacker can change MFA methods, set up mailbox rules to hide their activity, and move laterally within minutes.
Sources: SoSafe Awareness, BeyondTrust, Material Security, Hoxhunt, MITRE ATT&CK T1621.
What are the warning signs of MFA fatigue?
- A rapid series of MFA push notifications on your phone when you are not trying to log in
- Phone calls or messages claiming to be from IT support asking you to approve a login
- MFA prompts arriving late at night or early morning when you are less alert
- An attacker may follow up with a message impersonating IT, urging you to approve
- Your password was recently compromised in a breach or phishing attack
What should you do if you are being bombarded with MFA prompts?
- Do not approve any MFA prompt you did not initiate.
- Deny all unexpected prompts and change your password immediately.
- If your employer uses number-matching MFA, enable it — it prevents blind approval.
- Switch to phishing-resistant authentication where available: passkeys, FIDO2 security keys, or Windows Hello.
- Report the flood of prompts to your IT or security team — it means your password is compromised.
- Check your account for unauthorized sign-ins, mailbox rules, or MFA method changes.
How does PhishGlass help with MFA fatigue?
MFA fatigue attacks start with a phishing email or credential theft. PhishGlass helps by detecting the phishing message that precedes the attack:
- Identifies phishing emails that steal credentials used in MFA fatigue attacks
- Detects social-engineering pretexts where attackers impersonate IT support
- Flags messages that ask you to disable MFA or approve unexpected login prompts
- Provides a risk score and recommended action before you engage with the message
Note: PhishGlass analyzes the phishing message, not your MFA prompts. For MFA prompt security, use number-matching, passkeys, or FIDO2 security keys.