MFA Fatigue (Push Bombing).

Attack in which an adversary with a valid password floods the victim with MFA push prompts until the user approves one out of confusion or annoyance. It belongs to the Identity & Access category of cybersecurity.

Attack in which an adversary with a valid password floods the victim with MFA push prompts until the user approves one out of confusion or annoyance.

MFA fatigue, also called push bombing, exploits push-based multi-factor authentication. After obtaining a valid password through phishing or credential stuffing, the attacker repeatedly initiates logins, triggering a stream of mobile push approvals on the victim's phone. Eventually the user taps Approve to make the noise stop, or believes the prompt is legitimate. Notable incidents include the 2022 Uber breach and the 2022 Cisco intrusion, both linked to Lapsus$ and EXOTIC LILY tradecraft. Mitigations include number matching, push verification with context, rate limiting prompts, blocking after repeated denials, and migrating to phishing-resistant FIDO2 or passkeys.

Defences for MFA Fatigue (Push Bombing) typically combine technical controls and operational practices, as detailed in the full definition above.