Category hub: Social engineering and human risk

In one sentence: An MFA fatigue attack is when a criminal who already has your password keeps sending login approval requests to your phone until you tap Approve just to make them stop.

What it is

Multi-factor authentication adds a second check after the password. Many apps do this with a push notification: “Is this you? Approve or Deny.” In an MFA fatigue attack the criminal already has the password and tries to log in again and again, so your phone keeps buzzing.

MITRE ATT&CK lists this as T1621, Multi-Factor Authentication Request Generation. MITRE says attackers may abuse automatic push notifications from services such as Duo Push and Microsoft Authenticator, repeating attempts to bombard the user with pushes, texts and calls until they accept. The weak point is the person, not the cryptography.

How it works

1. The attacker gets a valid username and password, from phishing, an earlier breach or an infostealer log.
2. The password alone is not enough, so they trigger the login again and again.
3. The user’s phone shows prompt after prompt, often at night or in a meeting.
4. The attacker may also pose as IT support and say the prompts will stop if the user approves.
5. One tap on Approve completes the login. The attacker may then add their own device as a trusted method.

CISA’s Scattered Spider advisory lists push bombing among the methods the group uses.

Who it affects and how badly

• Sole trader to 10 staff. One approved prompt on a Microsoft 365 or Google account gives access to email, files and the bank.
• 10 to 250 staff. Accountancy, legal, recruitment and estate agency mailboxes hold client and payment data. SaaS firms and MSPs may expose many customers through one admin account.
• 250 plus and regulated firms. Admin accounts and remote access tools are the real target. An approved prompt can lead to a reportable breach.

Phishing-resistant MFA, such as security keys, removes the simple approve button this attack depends on.

Real examples

• Scattered Spider. The FBI and CISA advisory AA23-320A documents this group’s use of social engineering including push bombing, phishing and SIM swap attacks to obtain credentials. It was first published in November 2023 and updated in July 2025.
• MITRE ATT&CK T1621 lists public reporting of the technique, including a February 2024 advisory from the UK NCSC and partners on SVR cyber actors. We have not opened that advisory, and we have not named a victim organisation because we did not see a primary statement from one.

How to detect it

• Several MFA prompts in a short time for one user. MITRE advises watching for excessive push notifications and repeated challenges for the same session.
• Failed password logins followed by MFA challenges in quick succession.
• In Microsoft Entra ID sign-in logs, repeated MFA requests or denials for one user.
• Users reporting prompts they did not trigger, or a new authentication method on their account.

How to fix or prevent it

1. Move admin, finance and remote access accounts to phishing-resistant MFA, such as FIDO2 security keys or passkeys.
2. Turn on number matching, where the user types a number from the login screen, in your authenticator app.
3. Show app name and sign-in location in the prompt, where supported.
4. Tell staff: if you did not just try to log in, tap Deny and report it.
5. Make reporting quick and blame-free.
6. If an unexpected prompt appears, reset the password and revoke sessions, since someone has the password.
7. Alert on prompt storms.
8. Check for stolen passwords with a breach exposure check.

Related terms

• Multi-factor authentication
• Phishing-resistant MFA
• Credential stuffing
• Infostealer malware
• Impersonation of IT support
• Adversary-in-the-middle phishing

FAQ

What is MFA fatigue?
An attack where someone with your password triggers many approval prompts until you approve one.

Does stronger MFA stop it?
Phishing-resistant MFA, such as security keys, removes the simple approve prompt. CISA recommends it in its Scattered Spider advisory.

What should I do if I get a prompt I did not start?
Deny it and report it. The password may be stolen, so it should be reset.

Sources

• https://attack.mitre.org/techniques/T1621/
• https://attack.mitre.org/detectionstrategies/DET0160/
• https://www.cisa.gov/sites/default/files/2023-11/aa23-320a_scattered_spider_0.pdf
• https://www.prophetsecurity.ai/blog/what-is-mfa-fatigue-attack-mfa-bombing-best-practices

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.