Push Notification Attack

A push notification attack is an MFA bypass technique where attackers flood a user with repeated authentication prompts until one is approved. The method exploits fatigue, confusion, or social engineering rather than breaking the underlying factor. It remains effective when organisations depend on approval-based authentication without stronger controls.

Expanded Definition

Push notification attack describes an MFA fatigue technique aimed at approval-based sign-in flows, where repeated prompts are sent until a user accepts one out of annoyance, distraction, or misplaced trust. It is not a cryptographic break; it is a control-weakening tactic that targets human behaviour inside the authentication workflow. In NHI and IAM operations, the term is often discussed alongside push bombing, MFA spamming, and approval fatigue. Definitions vary across vendors, but the operational pattern is consistent: an attacker already has a password, session token, or other foothold and is trying to convert that partial access into a full authenticated session. Guidance from NIST SP 800-53 Rev 5 Security and Privacy Controls reinforces the need for stronger authentication design, but no single standard governs this exact attack label yet. The most common misapplication is treating any MFA failure as a push notification attack, which occurs when the real issue is stolen credentials, weak conditional access, or a misconfigured approval workflow.

Examples and Use Cases

Implementing push-based MFA at scale often introduces a usability-security tradeoff, requiring organisations to weigh sign-in convenience against the risk that users will approve a malicious prompt under pressure.

• An attacker signs in with a stolen password and sends repeated prompts until the target taps approve to stop the interruptions.
• A help desk impersonation campaign is paired with prompt flooding so the victim becomes conditioned to accept the next request.
• A privileged admin receives a burst of approvals during off-hours, then the attacker uses the resulting session to access cloud consoles or internal tools.
• Security teams compare this behaviour with patterns documented in the Top 10 NHI Issues and correlate it with attacker tradecraft in the MITRE ATT&CK Enterprise Matrix.
• In mature environments, the same event is blocked by number matching, phishing-resistant MFA, device binding, or risk-based challenge escalation rather than a plain approve/deny push.

For incident patterning, the 52 NHI Breaches Analysis is useful when prompt abuse is tied to credential compromise and session hijack behavior, while CISA cyber threat advisories provide broader adversary context for social engineering campaigns.

Why It Matters in NHI Security

Push notification attack matters because it exposes a weakness in identity assurance, not just user discipline. When approval-based MFA is the final barrier, a compromised password can become a live session with no additional proof of device integrity, location confidence, or intent. In mixed human and NHI environments, this matters even more because a successful human login can unlock secrets, API keys, and automation paths that extend the blast radius far beyond the first account. NHI Management Group research shows that 79% of organisations have experienced secrets leaks, with 77% of those incidents causing tangible damage, and that 97% of NHIs carry excessive privileges, which magnifies the impact of any authenticated foothold. That is why prompt fatigue often becomes a gateway event rather than a standalone nuisance. The most relevant defensive response is to reduce approval-only trust and move toward phishing-resistant methods and tighter conditional access, as reflected in the Ultimate Guide to NHIs — Why NHI Security Matters Now and Ultimate Guide to NHIs — Key Challenges and Risks. Organisations typically encounter the real cost only after an attacker has used one approved prompt to establish persistence, at which point the term becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• Attack Surface Management
• What do organisations get wrong about push notification MFA?
• What breaks when push-based MFA is exposed to repeated notification attacks?
• Why do push notification approvals create a persistent authentication risk for organisations?