The short answer
MFA fatigue is an attack where someone who already has your stolen password logs in repeatedly. Each attempt floods your phone with MFA push notifications until you approve one out of exhaustion. It’s one of the most common ways attackers get past multi-factor authentication, even when it’s set up correctly.
Multifactor authentication (MFA) asks you to prove your identity with more than just a password, usually using a code, a push notification, or a fingerprint. It’s an essential security layer, but it isn’t foolproof: attackers have found ways around it even when it’s working exactly as designed. MFA fatigue attacks, despite not being particularly sophisticated, are one of the most common ways attackers get around MFA.
In the guide below, we break down what you need to know about MFA fatigue: how to spot the attacks and how to protect your organization with the latest security practices.
What is MFA fatigue?
Quick Definition
Multi-factor authentication fatigue attacks (also known as MFA bombing or MFA spamming) happen after an attacker has already gotten hold of your username and password, usually through a data breach or a phishing email. Instead of stopping there, they repeatedly try to log in with those stolen credentials, and each attempt sends you an MFA push notification.
The purpose behind this flood of notifications is to exhaust you into approving one of them by mistake. That single approval grants the attacker access.
Although MFA provides an additional layer of security, you must have a basic understanding of the mechanics of MFA fatigue attacks to develop effective preventive measures.
A study from Microsoft found that over 382,000 MFA fatigue attacks were recorded during the 12-month period they tracked. It also showed that 1% of users would “blindly” accept the first MFA push notification they receive on their mobile.
Techniques used in MFA fatigue attacks
| Technique | How it works |
|---|---|
| Social engineering tactics | Attackers manipulate users into approving fraudulent authentication requests through phishing emails, phone calls posing as legitimate organizations, or impersonation of trusted contacts. |
| Contextual authentication manipulation |
|
| Push spam attacks |
|
Real-life examples of MFA attacks
Uber (2022)
In 2022, Uber fell victim to a breach when a contractor’s personal device was infected with malware. The hacker purchased the leaked credentials on the dark web and used them to log in to the contractor’s Uber account, which triggered MFA requests. Repeated MFA requests led to “MFA fatigue,” and a request was eventually accepted. That gave the hacker access to the account, and they escalated the attack from there.
In this case (luckily for Uber) the hacker wasn’t intent on stealing customer data and instead was just looking for a thrill or bragging rights.
MGM and Caesar’s (2023)
MGM and Caesar’s casinos were also victims of MFA attacks through social engineering.
In the MGM case, a phone call was used to trick a help desk employee into resetting the company’s MFA methods. This led to a ransomware attack.
MGM opted not to pay the ransom, but Caesar’s negotiated a $15 million payout to threat actors.
Cisco (2022)
In the case of Cisco, threat actors targeted the personal Google account of one of their employees.
Hackers were able to access their credentials via Chrome, which had been configured to sync passwords.
They then sent a wave of push requests to the employee’s mobile device as well as multiple fake phone calls where the caller claimed to be with a support provider, eventually gaining access and stealing company data.
How to spot MFA fatigue attacks
Here are some of the key indicators of an attack:
Frequent authentication requests
An unusual surge in authentication requests, especially outside of regular login attempts, could signal an ongoing attack.
Requests without prior login attempts
Receiving authentication prompts without having initiated a login process should raise immediate red flags.
Patterns in request timing
Attackers may execute these attacks during off-hours or when they presume you or your employees are less likely to scrutinize the requests carefully.
Unrecognized geographical locations
Alerts originating from unfamiliar locations suggest unauthorized attempts to gain access.
Repeated push notifications
A continuous stream of push notifications asking you to approve a sign-in can be an attempt to exploit user fatigue.
Overview: How to prevent MFA fatigue attacks in your organization
Implement adaptive authentication
Adaptive authentication adjusts security requirements based on real-time signals like location, device, and user behavior. It tightens checks when something looks unusual and eases off when it doesn’t. This cuts down on unnecessary authentication prompts while keeping security just as strong.
Educate employees about multi-factor authentication
Training should help employees understand why MFA matters and how to use it correctly, including the specific role it plays in protecting sensitive data and systems from unauthorized access.
Utilize risk-based authentication mechanisms
Risk-based authentication scores each action, like accessing sensitive data or making an admin change, and only asks for extra verification when that specific action calls for it. This means routine, low-risk logins don’t generate constant MFA prompts in the first place, so there’s less fatigue for an attacker to exploit.
Prioritize strong password hygiene
Weak, reused passwords are easier for attackers to steal, and every stolen password is another way for them to trigger the MFA prompts that lead to fatigue.
Enforcing strong password policies, including regular password updates and complexity requirements, can reduce the need for frequent MFA prompts.
We’d recommend using a password manager to generate and manage complex passwords securely.
Keep on top of unusual user behavior
Continuous monitoring of user activity helps detect anomalies and early signs of MFA fatigue, such as excessive authentication attempts or access patterns that don’t match a user’s normal behavior.
MFA fatigue attack prevention deep dive
Social engineering
Quick Definition
This style of attack involves bad actors exploiting psychological manipulation techniques to exhaust people into approving fraudulent authentication requests in MFA systems.
Techniques attackers use
| Technique | How it works |
|---|---|
| Phishing emails | Threat actors send deceptive emails posing as legitimate entities, asking you to verify your credentials by clicking on malicious links or downloading attachments. |
| Fake login pages | Attackers set these up to closely resemble legitimate websites. This tricks you into entering your credentials. They’re often distributed through phishing emails or malicious websites. |
| Urgency and fear tactics | Bad actors coerce users into quickly responding to authentication requests using psychological triggers like urgency or fear. |
How can you prevent it?
- Security awareness training: Educate employees about the dangers of social engineering attacks and how to recognize common tactics like phishing emails and fake websites.
- Stronger multi-factor authentication systems: Implement MFA systems that offer additional layers of security beyond passwords, such as biometric authentication or hardware tokens.
- Two-way authentication: Require employees to verify authentication requests through a second channel, like email, SMS, or a phone call, to confirm their identity.
- Secure communication channels: Encourage employees to only provide sensitive information or authenticate through secure communication channels, such as encrypted websites or official mobile apps.
- Verification of requests: Advise employees to verify suspicious requests directly with IT support, or by logging into their account through official channels, not through the request itself.
Push spam attacks
Quick Definition
This involves cybercriminals bombarding users with a high volume of fraudulent push notification requests. This wears them down until they accidentally approve one.
Techniques attackers use
| Technique | How it works |
|---|---|
| Floods of requests | Attackers flood your devices with a stream of push notification requests. This makes it difficult to distinguish legitimate ones from fraudulent ones. |
| Urgent or threatening messages | Cybercriminals send urgent or threatening messages that coerce you into approving authentication requests out of fear or concern. |
| Fake alerts or promotions | Attackers disguise push notifications as alerts or promotions from reputable organizations or services. |
How can you prevent it?
- Employee education: Educate users about the risks of push spam attacks, and encourage them to stay wary of push notifications that seem unusual or unexpected.
- Rate limiting: Limit how many authentication push notifications your MFA system sends to an employee within a set time frame, to prevent overwhelming them with requests.
- Contextual information: Configure your MFA system’s push notifications to include context, like the user’s recent activity or location, so employees can spot a fake request more easily.
Credential stuffing
Quick Definition
Attackers exploit reused or compromised credentials to gain access to an account.
Techniques attackers use
| Technique | How it works |
|---|---|
| Credential database compromises | Attackers obtain databases of compromised credentials from previous data breaches or leaks. They then use automated tools to systematically test these credentials against various online accounts, including those protected by MFA. |
| Brute force attacks | Cybercriminals use automated scripts or tools to systematically guess passwords for user accounts. By employing a large volume of login attempts, attackers attempt to bypass MFA protections and gain access to accounts through trial and error. |
| Credential phishing | Attackers use phishing emails or fraudulent websites to trick users into disclosing their login credentials, which can be used in credential stuffing attacks to gain access to user accounts, even if they’re protected by MFA. |
How can you prevent it?
- Strong password policies: Require employees to use complex, unique passwords for every account. This limits the damage a credential stuffing attack can do.
- Account lockout mechanisms: Implement account lockout mechanisms that temporarily lock user accounts after a certain number of failed login attempts. This helps prevent brute force attacks by limiting the number of login attempts an attacker can make.
- Monitoring and detection: Use monitoring and detection mechanisms to identify unusual login activity or suspicious patterns in user behavior.
Man-in-the-middle (MitM) attacks
Quick Definition
Attackers intercept and manipulate communications between users and authentication systems to bypass MFA protections.
Techniques attackers use
| Technique | How it works |
|---|---|
| DNS spoofing | Attackers modify DNS (Domain Name System) responses to redirect you to fraudulent websites or servers controlled by the attacker. By intercepting traffic between the user and the legitimate authentication system, attackers capture authentication credentials and bypass MFA protections. |
| SSL stripping | Normally, HTTPS encrypts your connection to a website, so no one in between can read what you send. In an attack known as SSL stripping, attackers secretly force that connection to downgrade to the older, unencrypted HTTP version instead. This lets them read and even change the traffic between you and the authentication system, and that’s how they get around MFA. |
| Rogue Wi-Fi networks | Attackers set up Wi-Fi networks with similar names to legitimate networks to trick you into joining them. From there, they intercept and manipulate traffic to capture authentication credentials and bypass MFA. |
How can you prevent it?
- HTTPS: Enforce the use of HTTPS for all communication between employees and authentication systems to prevent SSL stripping attacks. Ensure that SSL/TLS certificates are properly configured and regularly updated to maintain secure connections.
- Network segmentation: Implement network segmentation to isolate critical authentication systems from untrusted networks and devices. Restrict access to authentication systems to authorized users and devices only, and monitor network traffic for signs of unauthorized access or suspicious activity.
- VPNs and secure channels: Encourage employees to use VPNs or other secure channels when accessing authentication systems from remote or untrusted networks.
If you want to go the extra mile: use these security measures to enhance MFA
- Hardware security keys: They offer a physical token for authentication, which reduces the risk of phishing attacks and MFA fatigue.
- Biometric authentication: Methods like facial recognition use unique biological traits for identity verification.
- Privileged access management (PAM): PAM restricts access to your systems and data, so you can choose who gets access to what.
Change security behaviors at scale with Hoxhunt
Recognizing an MFA fatigue attack is only half the battle. The other half is knowing how to react in the moment, and that’s exactly where typical security awareness training falls short.
That’s why our advanced AI engine personalizes and delivers frequent simulations at scale. This turns your highest-risk employees into an extra layer of human threat detection against real attacks.
Hoxhunt gives security teams a complete picture of risk and behavior change outcomes:
6xDrop in phishing failure rate across Qualcomm’s global workforce (United States)Read the Qualcomm case study →
15xRise in real-threat reporting at Bird & Bird, from 60 to 900 reports a month (Europe)Read the Bird & Bird case study →
MFA Fatigue FAQ
What is an MFA fatigue attack?
MFA fatigue, also called MFA bombing or MFA spamming, happens when attackers flood a user with repeated authentication prompts until they approve one out of exhaustion or frustration. That single approval hands the attacker access.
How do MFA fatigue attacks work?
MFA fatigue threats often involve social engineering attacks or technical exploits to manipulate users into approving fraudulent authentication requests. Attackers use techniques such as push spam, contextual authentication manipulation, or credential stuffing to bypass MFA protections and gain unauthorized access to user accounts.
What is the best course of action to defend against MFA fatigue?
Organizations can prevent MFA fatigue attacks by implementing adaptive authentication mechanisms, educating users about MFA best practices, and using risk-based authentication mechanisms. Enforcing strong password hygiene, monitoring user behavior, and implementing security awareness training programs can also help mitigate the risk of MFA fatigue attacks.
What are the potential consequences of MFA fatigue attacks?
The potential consequences of MFA fatigue attacks include unauthorized access to sensitive data, financial loss, reputation damage, and regulatory penalties.
Get more cybersecurity insights like this
- Subscribe to All Things Human Risk to get a monthly round up of our latest content
- Request a demo for a customized walkthrough of Hoxhunt
.avif)
.avif)