MFA Fatigue Attacks: How to Beat Push Bombing Before You Tap Approve

MFA fatigue attacks work by annoying you into surrendering. An attacker who already has your password fires off login requests one after another, and your phone buzzes with Approve prompts until you tap one just to make it stop — and that's the whole attack. It's also called push bombing, and in 2026 it remains a live initial-access vector for ransomware crews. Here's how it works, the red flags, and the defenses that actually shut it down.

How MFA fatigue attacks actually work

The setup is simple. The attacker has your username and password — bought from a breach dump, scraped by an infostealer, phished last month. They trigger a login attempt, which sends a push prompt to your phone: "Approve sign-in?" You deny it. They trigger another. And another. And another.

The pressure usually comes at the worst moment: late at night, when you're tired, mid-meeting, in the middle of dinner. Sometimes it's paired with a fake call — "Hi, this is IT, we're testing the new VPN, just tap Approve" — the classic vishing reinforcement. MITRE ATT&CK catalogs the technique as T1621, MFA Request Generation, which tells you it's formal enough to have its own entry.

The trap isn't technical. It's patience. Push-based MFA asks you to make the same correct decision — deny, deny, deny — dozens of times in a row. Humans fail that test at a measurable rate, and attackers only need you to fail once.

The Uber lesson from 2022

The textbook case is still Uber. In September 2022, an Uber contractor was hit with a wave of MFA push prompts that kept coming for nearly an hour. Eventually, just to make the buzzing stop, the contractor tapped Approve. That single tap handed the attacker — linked to the Lapsus$ crew — access to Uber's internal systems, cloud consoles, and security tooling.

Nothing about that victim was careless in the normal sense. They had a password and MFA, did everything the training told them to do, and were simply ground down. That's what makes MFA fatigue attacks so dangerous: they don't defeat your security by being smarter than it. They defeat it by being more stubborn than you.

The warning signs

Treat any of these as an active incident, not a glitch:

• Push prompts you didn't trigger. The golden rule: never approve a 2FA prompt unless you are logging in at that exact second.
• Multiple prompts in quick succession. One stray prompt is odd. A burst of them is an attack.
• They arrive late at night. Attackers time floods for when you're half asleep.
• A call or message claiming to be IT urging you to approve "a test" or "an update."
• Pushes for a service you haven't used in weeks. Stale-credential stuffing from an old breach is in progress.

This isn't theoretical in 2026. Central Ohio Primary Care disclosed on October 15 that a vishing attack exposed roughly 1.4 million patients' and employees' records — voice phishing paired with credential abuse remains one of the year's biggest breach stories. Social engineering, whether by voice or by notification, keeps working because it targets people, not protocols.

How to defend against push bombing

What you can do right now:

• Never approve a prompt you didn't initiate. Deny it, then report it through your security team or the app. Every uninitiated prompt is a burglar rattling your door.
• Turn on number matching. Microsoft Authenticator, Google, Duo, and Okta all support it: instead of tapping Approve, you type a number shown on the login screen into the app. The attacker doesn't have that number, so flooding the channel achieves nothing.
• Enable additional context. Most authenticator apps can show the app, location, and device behind a login request. A push from a country you've never visited is a decision you can make in one glance.
• If you slipped and tapped Approve: change your password immediately from a clean device, revoke all active sessions, and call your IT team. Speed matters more than embarrassment.
• If you run IT: cap push attempts (Microsoft's guidance is roughly three before lockout), alert on bursts of denied prompts per account, and train people to treat a prompt flood as an incident to report — not an annoyance to dismiss.

And keep the basics tight: unique passwords everywhere via a password manager (if they can't get your password, they can't start the flood), and a backup plan — losing your phone is a 2FA crisis of its own, so set up backup codes now.

The push-proof fix: passkeys

The permanent answer is to remove the thing being attacked. Push prompts can be bombed; passkeys and FIDO2 hardware keys cannot — there's no Approve button, just a cryptographic signature bound to the real login domain. No prompt means no fatigue, no fake-IT call that ends with a tap.

The industry is moving that way: the FIDO Alliance's 2026 numbers put enterprise passkey deployment at roughly two-thirds of surveyed organizations, and CISA treats number matching as the interim defense while phishing-resistant MFA becomes the baseline. Number matching today, passkeys tomorrow. The sooner you migrate your most important accounts — email, cloud, finance — the sooner a flood of prompts becomes something you simply never see. And while you're hardening your login flow, fake QR codes are the other popular MFA-bypass trick worth learning to spot.