Insider recruitment and MFA bombing raise identity risk stakes

At a glance

What this is: Anomali describes how Medusa combined insider recruitment and MFA bombing to pressure a BBC reporter, showing how access abuse and authentication fatigue can be chained together.

Why it matters: IAM and security teams need to treat employee targeting, approval fatigue, and reporting channels as part of identity control design, not as separate awareness issues.

Context

This article is about a blended identity attack pattern, not a single ransomware tactic. The core problem is that attackers can start with social engineering aimed at an employee, then move to authentication abuse when persuasion fails.

For identity programmes, that means the control surface is broader than account policy. Insider risk, MFA resilience, and fast reporting paths all sit in the same operational chain when attackers target the person behind the identity.

Key questions

Q: What breaks when attackers combine insider recruitment with MFA bombing?

A: The control assumption that users will either refuse the approach or recognise the authentication abuse in time. Recruitment weakens human resistance, while prompt flooding can exhaust attention and increase the chance of an accidental approval. When both are chained together, traditional identity controls that focus only on credentials miss the human decision layer the attacker is actually targeting.

Q: Why do repeated MFA prompts increase breach risk instead of proving stronger security?

A: Repeated prompts increase risk because they create fatigue, normalise approval behaviour, and turn authentication into a pressure test. A system that depends on a user to reject every hostile request can be worn down, especially when the attacker already has valid first-factor credentials and only needs one mistake.

Q: How should security teams handle insider recruitment attempts before access is gained?

A: Treat the approach itself as a security event, not a private employee matter. Give staff a fast reporting path, preserve chat or message evidence, and trigger an identity review for the targeted account. The goal is to intervene before the attacker turns social pressure into a usable login, approval, or privileged session.

Q: What should organisations do when an employee reports suspicious contact and login prompts?

A: Treat it as a potential multi-stage identity attack, not a routine help-desk issue. Contain the account, review recent authentication activity, and check whether the same user was approached through messaging or email. The goal is to stop the attacker’s next move before they can shift from persuasion to approval abuse.

Technical breakdown

Insider recruitment as an access path

Insider recruitment is a human-focused initial access technique: instead of breaking authentication directly, the attacker tries to turn an employee into a cooperating access path. In this case, the approach began in Signal with a revenue-share offer, which is a coercive trust play rather than a technical exploit. The attacker’s logic is simple. If one person can be convinced to bridge the gap, the group can bypass perimeter controls, monitoring thresholds, and many preventive access checks that assume the human will refuse the approach.

Practical implication: monitor for suspicious outreach patterns and ensure employees know how to escalate covert recruitment attempts immediately.

MFA bombing and approval fatigue

MFA bombing works by generating repeated push or login prompts until the target accepts one out of annoyance, confusion, or a desire to clear the interruption. The tactic is effective when authentication is treated as a single event rather than a sequence of human decisions under pressure. This is not a compromise of the MFA system itself. It is an abuse of the user interaction layer, where excessive prompts can create fatigue, habituation, and errors that adversaries can exploit without ever knowing the password.

Practical implication: reduce repeated approval prompts and investigate any cluster of denied or ignored login requests as a live attack signal.

Why social engineering and authentication abuse combine so well

The combination matters because each stage reinforces the other. A recruitment attempt tests whether the employee can be turned into an insider, and if that fails, MFA bombing shifts the attack from persuasion to disruption. That gives the attacker two ways to reach the same objective: get access or create enough friction to increase the chance of a mistaken approval. Identity teams should read this as a single campaign shape, not two isolated incidents.

Practical implication: align social engineering response playbooks with authentication telemetry so one channel can validate the other in real time.

Threat narrative

Attacker objective: The attacker wanted internal access through insider cooperation or a mistaken MFA approval that would let Medusa reach the BBC environment.

1. The attack began with contact over Signal, where the actor tried to recruit the BBC reporter as an insider by offering a cut of ransom proceeds in exchange for internal access.
2. When persuasion failed, the actor shifted to repeated MFA prompts against the BBC account, using approval fatigue as the escalation mechanism.
3. The objective was to convert a human target into a path to internal systems or, failing that, to force an authentication mistake that would open access.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Insider targeting and MFA bombing are one identity problem, not two. The recruitment pitch and the repeated authentication prompts belong to the same access strategy: change the human decision state until the defender loses control of the session. That means identity governance has to include behaviour under pressure, not only credential state. Practitioners should treat employee targeting and authentication abuse as linked controls on the same attack path.

Authentication fatigue is a control weakness, not a user mistake. Repeated prompts only become viable when the organisation allows a login experience that can be worn down. The issue is not that users are careless in the abstract, but that the control model assumes prompt volume will stay below a human tolerance threshold. The implication is that MFA design must account for adversarial persistence, not just routine access.

Insider risk becomes more credible when attackers can frame the offer as social proof. Medusa’s claim of previous success against healthcare and emergency service providers is part of the persuasion layer, whether true or exaggerated. The governance lesson is that employees do not evaluate threat outreach in a vacuum. Practitioners should assume that attackers will mix reputation, urgency, and financial pressure to make cooperation feel less exceptional.

Identity programmes need a reporting loop that is faster than the attacker’s escalation loop. Once an employee is approached, the window for response is measured in minutes, not policy cycles. If the reporting channel is slow or unclear, the attacker gets more time to pivot from recruitment to authentication abuse. Security teams should design incident handling so the first suspicious contact can trigger containment before account pressure intensifies.

What this signals

Human-targeted identity attacks now blend persuasion with authentication pressure. Security teams should stop treating insider recruitment and MFA bombing as separate categories, because attackers chain them to exploit both judgment and login behaviour. The programme implication is clear: reporting, detection, and response need to be designed around the human-in-the-loop attack path, not just the account.

Authentication controls must be designed for adversarial repetition. A prompt that can be worn down is not a stable control, even if the underlying factor is sound. Identity teams should look for approval fatigue, repeated push requests, and any process that assumes the user experience will always remain calm enough for careful decision-making.

For practitioners

• Tighten suspicious outreach reporting Create a simple, well-publicised path for employees to report recruitment attempts, impersonation, and other covert contact before the attacker escalates to account abuse.
• Reduce MFA prompt abuse Review push-based authentication flows that allow repeated prompts and tune them to avoid approval fatigue, especially for high-value accounts.
• Correlate identity and user reports Feed employee-reported suspicious contact into authentication monitoring so repeated login prompts and social engineering alerts are investigated together.
• Train for coercive insider approaches Use scenario-based training that covers offers of money, appeals to grievance, and claims of prior success, because those tactics are designed to change judgment under pressure.

Key takeaways

• The article shows that attackers can move from social engineering to authentication abuse in one continuous identity attack path.
• Repeated MFA prompts are dangerous because they target user fatigue, not just credential strength.
• Identity teams need reporting, detection, and response processes that connect suspicious outreach to login anomalies.

Key terms

• Insider Recruitment: The attempt to turn a legitimate employee, contractor, or partner into an access facilitator for criminal activity. The recruit may be asked to share credentials, approve a login, or use their own trusted access. In identity governance terms, it is a coercion-driven pathway into authorised systems.
• Mfa Bombing: A social engineering tactic that overwhelms a user with repeated authentication prompts until they approve one by mistake or out of frustration. It does not usually defeat the authenticator itself. Instead, it exploits human behaviour and weak notification design to convert a legitimate login flow into an access bypass.
• Approval Fatigue: The point at which repeated approval requests cause users to stop evaluating each one carefully. In agent governance, this is a control failure mode because the human reviewer becomes desensitised, making the oversight layer ineffective even though the workflow still appears compliant.
• Social Engineering Escalation: Social engineering escalation is the practice of increasing access by persuading a human operator to approve actions that the attacker could not obtain through normal system controls. In help desk attacks, it turns a support interaction into an access-control exception with real security consequences.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.