MFA Fatigue Attacks: The Hack That Just Asks Until You Say Yes
TL;DR:
An MFA fatigue attack does not break your login. It nags you until you open it yourself.
Think of it like a doorbell that starts ringing at 2am and will not stop. Ring. Ring. Ring. After the twentieth one you are not deciding whether to let anyone in. You are deciding how to make the noise end.
That is the entire attack. Somebody already has the password, and the only thing standing between them and the account is a prompt on a phone. So they send it fifty times, and wait for a tired human to tap Approve just to get back to sleep. No exploit, no clever code. Patience.
Beyond the Basics:
Here's the shift: once MFA became standard, attackers stopped attacking the technology and started attacking the person holding it.
This only works because the password is already gone. Credential dumps, phishing kits, and reused logins hand attackers a valid password constantly. What they hit next is the last gate, and if that gate is a push notification, it is a gate operated by a distracted human.
- The attacker signs in with the stolen password. Everything up to the second factor succeeds, because that half is legitimate.
- The push prompt fires on the real user's phone. From the system's perspective this is a normal sign-in awaiting approval.
- They repeat it, dozens of times. Overnight is preferred. So is the middle of a meeting, or anywhere attention is already spent.
- One approval ends it. The session is real, issued by the identity provider, and looks entirely legitimate in the logs.
Uber lost a contractor account exactly this way in 2022. The attacker paired push spam with a message claiming to be internal IT, and the prompts stopped once the target approved one.
In a Microsoft environment, number matching is the direct answer. Authenticator shows a number on the sign-in screen that the user has to type, so approval stops being a reflex and starts requiring the attacker's screen. Microsoft now enforces it by default. Conditional Access adds sign-in risk and location conditions on top, and repeated failures should be alerting somebody.
Here's the catch: number matching raises the cost, it does not remove the target. A prompt still exists, and a convincing phone call from fake IT still talks people through it. The only version of this attack with no answer is the one with nothing to approve, which is what FIDO2 and passkeys give you. Fix the prompt this quarter, then get rid of it.