MFA Fatigue Attack: How Push Bombing Works and What Stops It

An MFA (multi-factor authentication) fatigue attack, also called push bombing, uses a stolen password to send a stream of MFA prompts to a user until they approve one, by mistake or just to make the prompts stop. The attack relies on the user's patience running out and on defenders treating each denied prompt as noise.

Where it's enforced, number matching has taken away the cheapest version of the attack, the blind tap. The attacks that remain pair push prompts with voice calls, help desk resets, and real-time phishing proxies that relay the number to the user. They are harder to catch and take more than a settings change to stop.

TL;DR:

• In password-based sign-in flows, a push prompt fires only after the password check passes, so a burst of denied prompts usually means the password is already in an attacker's hands.
• Number matching stops blind approvals, but a caller or a phishing proxy can relay the number. Approach it as an interim control while phishing-resistant MFA rolls out.
• Phishing-resistant MFA ties each sign-in to the real site, which leaves the user nothing to approve on an attacker's behalf.
• Detection thresholds flag the pattern, and deciding whether a user was bombed takes sign-in, device, and user context from the hour around the prompts.

How an MFA Fatigue Attack Unfolds

MITRE ATT&CK tracks the technique as Multi-Factor Authentication Request Generation, the abuse of automatic push notifications from services such as Duo Push, Microsoft Authenticator, and Okta.

It lists APT29, LAPSUS$, and Scattered Spider among the groups that use MFA fatigue attacks. The technique belongs to a wider family of MFA bypass techniques that also includes session token theft.

The Attacker Already Has the Password

In a normal sign-in, push MFA only comes into play once the password has been accepted, which means the attacker arrives with a working credential. In Cisco's 2022 breach, the attacker took an employee's corporate password from a personal Google account that was syncing passwords saved in the browser.

The Prompts

The attacker repeats the sign-in and lets the identity provider send each prompt, either to one user over and over or a few at a time across many users. Duo's risk engine tracks targeted push harassment and non-targeted push attacks as separate patterns.

The Approval

In Duo's push-attack data from June 2023 to May 2024, users accepted 5% of attack pushes, and most who accepted had received only one to five requests. Attackers appeared to move on when a user didn't answer and to aim for the U.S. peak between 8 and 9 a.m. Eastern, likely when most people sign in for the day.

In the 2022 Uber breach, an attacker who had likely bought a contractor's password after malware infected the contractor's personal device kept triggering approval requests until the contractor accepted one.

The First Hour After Approval

Attackers move fast to keep access past a password reset, often by registering an MFA method of their own. Mandiant's 2026 hardening guidance recommends watching for new MFA device registrations within 60 minutes of a sign-in from a new IP address or device. The rule was written for stolen session tokens and applies equally after an approved push.

At Uber, the attacker used the first account to reach other employee accounts and, through them, elevated permissions in tools including G Suite and Slack.

How Attackers Pair Push Bombing With Vishing and the Help Desk

In documented intrusions, push bombing often runs alongside a phone call that does much of the persuading. Scattered Spider actors have sent repeated MFA prompts until employees pressed Accept, posed as IT staff to get one-time passwords, and talked help desk staff into resetting passwords or transferring MFA tokens.

The help desk is often the softer target. In 2025, Scattered Spider used help desk voice phishing in almost all of the intrusions CrowdStrike observed through mid-year. In one case from Unit 42's 2025 social engineering report, an actor went from initial access to domain administrator in under 40 minutes, using only built-in tools and social pretexts.

Voice phishing was the second most common initial infection vector in Mandiant's M-Trends 2026, at 11% of intrusions, ahead of email phishing at 6%. When a vishing call does lead to a help desk reset, it can leave a tight cluster of telemetry within minutes.

The cluster can include an MFA enrollment in Okta, a new device authentication in Entra ID, and a remote access tool on an endpoint.

What Number Matching Fixed, and What It Left Open

Number matching makes the user type a number shown on the sign-in screen, which someone who didn't start the sign-in can't see.

Microsoft began enforcing number matching for all Authenticator push users after May 8, 2023. Okta lets admins require its number challenge for high-risk sign-ins or for every push, though Okta rates it weaker than passkeys and Okta FastPass. Duo's equivalent is Verified Duo Push.

Callers and phishing proxies can still get around it. Okta's threat intelligence team has seen phishing kits built for callers who simply tell the user which number to enter, and the Tycoon2FA kit showed the same prompt on its phishing page, number matching included, before capturing the session cookie.

Duo says even Verified Duo Push is still susceptible to certain attacks, and joint guidance from CISA, the NSA, the FBI, and MS-ISAC in 2023 treats number matching as the fallback for organizations that can't yet deploy phishing-resistant MFA.

Some sign-in paths bypass number matching altogether. Okta Verify skips the number challenge for RADIUS apps and Okta's LDAP Interface. Duo doesn't enforce Verified Duo Push for applications that still show its older traditional prompt.

How to Prevent MFA Fatigue Attacks

Phishing-resistant MFA closes the sign-in path, and the other controls shrink the attack window while that rollout runs.

Phishing-Resistant MFA for the Accounts That Matter Most

Phishing-resistant MFA covers FIDO2/WebAuthn passkeys and security keys, plus PKI-based methods such as smart cards.

An FBI and CISA advisory on Scattered Spider calls these methods not susceptible to push-bombing or SIM-swap attacks, a protection that applies at sign-in.

NIST SP 800-63B-4, finalized in July 2025, treats out-of-band authentication such as push approval as not phishing-resistant and requires federal agencies to have staff, contractors, and partners use phishing-resistant authentication.

Start with the accounts an attacker most wants: IT administrators, help desk staff with reset authority, and anyone who can change identity settings.

Number Matching Everywhere Push Still Exists

In Okta, set the number challenge to "All push challenges"; the setting then applies organization-wide.

In Duo, Verified Duo Push is off by default for Duo Advantage and Premier customers, so turn it on in the policy for every application that uses push and move those applications to the Universal Prompt.

In Entra, turn on application name and location in Authenticator notifications, which Microsoft's managed defaults leave disabled.

Rate Limits and Lockout

Duo has the most direct push throttle. With Frequent attempts turned on, Duo blocks pushes sent within 15 seconds of an unanswered one and makes the user wait a minute, and its lockout counter counts push timeouts too, with a default threshold of 10.

Entra has no documented push-volume throttle, and smart lockout is built for password guessing. In Okta, a denied Okta Verify push doesn't count toward the MFA failure limit, so a run of denials won't lock the account on its own.

User Reporting Wired to Risk

In Entra, Report suspicious activity replaced the legacy MFA fraud alert on March 1, 2025. A report sets the user to High risk for Entra ID P2 risk-based policies to act on, but the feature stays turned off under Microsoft's managed defaults until an admin enables it.

In Duo, a user who reports a fraudulent push alerts administrators and mutes further pushes for 20 minutes. In Okta Verify, tapping "No, It's Not Me" blocks that sign-in attempt.

Help Desk Verification and Re-Enrollment Limits

Knowledge-based caller checks give little protection against Scattered Spider, which often already has publicly available personal data such as a date of birth or the last four digits of a Social Security number.

Mandiant's hardening guidance for the group recommends a call-back to a registered number or confirmation through a known corporate email instead.

During periods of elevated threat, Mandiant also advises turning off self-service MFA resets and allowing MFA re-registration only from corporate or trusted IP locations.

In Entra, a Conditional Access policy on security info registration can enforce that. Microsoft now suggests a Temporary Access Pass, a time-limited credential an administrator issues, as an alternative to location rules, though issuing one needs the same caller verification.

Detecting MFA Fatigue in Progress

Identity providers log push denials differently, which makes push-bombing detection fragile. Okta records a denied push as user.mfa.okta_verify.deny_push in Classic Engine and as user.authentication.auth_via_mfa with the reason INVALID_CREDENTIALS in Identity Engine.

A push left to time out produces no corresponding log entry, a gap Red Canary flagged in 2022, and rules that count only denials miss users who ignore the prompts. The push-send event, system.push.send_factor_verify_push, is still logged, and counting it closes the gap.

In Entra ID, detection content usually keys on error code 500121 with the additional detail MFA denied; user declined the authentication. A single sign-in can appear as several Azure Monitor rows sharing one correlationId, so deduplicate before counting.

Red Canary calls its own threshold arbitrary, set with false positive rates in mind. A low-and-slow pattern like the one in Duo's data can stay under every row, so treat an approval that follows several unanswered or denied prompts as the highest-priority signal.

Published detection thresholds disagree on both the count and the window:

‍

Responding When a User Approves the Push

Reset the password and revoke sessions as separate steps. A password reset revokes some refresh tokens but can leave others alive, depending on the token type and where the reset happened.

Access tokens that were already issued usually stay valid until they expire, by default after 60 to 90 minutes (75 minutes on average), unless the application supports continuous access evaluation. Disable the account while you investigate so the stolen password can't start new sessions.

Next, reset the user's authenticators, which cancels the user's enrollments and forces them to re-enroll. Then look for persistence that survives the reset, including new MFA methods, OAuth consent grants with high-privilege scopes, inbox forwarding rules, new app registrations, and federation changes.

Where to Start Hardening Push MFA

Close the legacy push paths first. Okta RADIUS and LDAP Interface apps keep sending unverified push prompts after number matching is required everywhere else, as do VPN sign-ins through Microsoft's NPS extension for users with no one-time code method registered.

Assign those apps a different factor and register a code-based method for every NPS user. Move administrators and help desk staff to FIDO2 security keys, passkeys, or certificate-based authentication next, ahead of the general workforce.

While the broader rollout runs, close the volume gaps in your identity provider, replace knowledge-based help desk checks with call-backs to a registered number, and make sure detections count push sends as well as denials.

Why MFA Denial Alerts Need a Verdict

A denial-count alert can only say that something repeated. Deciding whether a user is being bombed means answering questions a threshold can't:

• Did the push request and the approval come from the same place?
• Is the device known to the organization?
• Did the user actually start the sign-in?
• Has the password turned up in a recent exposure?
• Did an MFA enrollment or OAuth consent follow?

Those answers sit across the identity provider, the EDR, HR systems, and the user, and often only the user knows whether the sign-in was theirs. When a SOC lacks the time to collect them, it closes the alert on pattern, and alert fatigue turns into missed compromises.

Daylight's MDR service investigates identity alerts this way, pulling sign-in, device, and organizational context into one investigation before reaching a verdict.

Frequently Asked Questions About MFA Fatigue Attacks

Is MFA Fatigue the Same as MFA Bombing or Prompt Bombing?

Yes. MFA fatigue, push bombing, MFA bombing, and prompt bombing all name the technique MITRE ATT&CK catalogs as Multi-Factor Authentication Request Generation (T1621). The labels vary by source: Verizon's 2025 DBIR calls it prompt bombing, CISA's advisories use push bombing, and Okta has used push fatigue.

Does MFA Fatigue Only Target Push Notifications?

No. MITRE's definition covers SMS messages and calls, not just push notifications. Attackers can also trigger prompts through self-service password reset when it's set up for push, even without a password. Plain push is the easiest to abuse because one tap approves the sign-in. An SMS code must be read to a caller or typed into a phishing page.

Is Push Bombing Still Common Enough to Prioritize?

Yes, though it makes up a small share of observed attack volume. Microsoft's 2026 Digital Defense Report puts password spray at over 99% of observed cloud initial access attempts, while noting that attackers have shifted to fatigue attacks and adversary-in-the-middle phishing to get around MFA. It still succeeds in real intrusions. In the second quarter of 2026, Cisco Talos found authentication abuse in 65% of its incident response engagements, with MFA fatigue among the ways attackers defeated MFA. Plan for it alongside vishing and help desk abuse.

Does Moving to Passkeys Close the Gap Completely?

No, because attackers can still target registration and recovery. Okta has tracked a vishing actor that, since April 2026, has used a phishing kit that targets passkey enrollment for Microsoft 365 users. Gate registration and recovery with the same rigor you apply to sign-in.

Should a Denied-Only Burst With No Approval Trigger a Password Reset?

Usually. Prompts triggered by sign-in attempts mean the attacker already has possession of the password, so rotate it even though nobody approved. If they came from a self-service password reset flow, the password may not be exposed, so review the reset activity and tighten reset verification. Either way, confirm with the user and check sign-in and audit logs for any success in the window.