MFA Fatigue Attack

Overview

Meaning and scope

An MFA fatigue attack repeatedly sends authentication prompts or approval requests to pressure, confuse, or trick a user into approving one, often after the attacker has obtained the password. It targets push-based approval behavior and is less effective against phishing-resistant authenticators that cryptographically bind authentication to the legitimate service.

Mechanism and operation

Operational implementation should prefer phishing-resistant MFA, use number matching and contextual prompts where push remains, limit request frequency, detect impossible patterns, educate users to report prompts, and secure help-desk recovery. The principal failure modes include prompt bombing, social engineering, accidental approval, compromised passwords, alert desensitization, attacker calls pretending to be support, and weak fallback authentication. Useful measures include phishing-resistant enrollment, denied unsolicited prompts, prompt-burst detections, user reports, and accounts compromised after MFA approval. Operationally, teams should prefer phishing-resistant MFA, use number matching and contextual prompts where push remains, limit request frequency, and detect impossible patterns.

Practical payment example

An attacker repeatedly pushes approval prompts to an employee’s authenticator. Security policy encourages reporting unexpected prompts and requires phishing-resistant verification for sensitive financial actions.

Operational checks

Assessment of MFA Fatigue Attack should trace MFA fatigue attack repeatedly sends authentication prompts or approval requests to pressure, confuse, or trick a user into approving one, often after the attacker has obtained the password from prerequisite and entry point through observable impact on the affected service.

Distinctions and limits

Key risks include prompt bombing, social engineering, accidental approval, and compromised passwords. A theoretical weakness or scanner result involving approval requests to pressure, confuse, and trick a user into approving one should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the MFA Fatigue attack path should be tested against the architecture associated with approval requests to pressure, confuse, and trick a user into approving one.

Related reading

Related definitions: Hardware Security Key, Passwordless Authentication.