MFA fatigue, also called push bombing or prompt bombing, is an attack on push-based multi-factor authentication. An attacker who already knows a user’s password triggers login prompts again and again. The aim is that the user, tired or confused, taps “approve” just to stop the alerts.

How it works

• The attacker obtains a valid password, for example from stealer logs, phishing or a breach.
• They start repeated logins, each of which sends a push notification to the user’s phone.
• The prompts often come late at night, or alongside a call or message from a fake IT helpdesk asking the user to accept.
• One approval is enough for the attacker to sign in and register their own device.

MITRE ATT&CK describes this as technique T1621, Multi-Factor Authentication Request Generation.

Why it matters for defenders

MFA fatigue shows that MFA is only as strong as its weakest method. CISA recommends phishing-resistant MFA, such as FIDO security keys, and suggests number matching where that is not yet possible, to block push bombing. Limiting prompts, alerting on repeated denials and training staff to report unexpected requests also help. Because the attack starts with a known password, finding leaked company credentials early removes the first step.

Sources: MITRE ATT&CK T1621: Multi-Factor Authentication Request Generation, CISA: More than a Password