MFA fatigue attacks expose the limits of push-based authentication

At a glance

What this is: This analysis explains how MFA fatigue attacks exploit repeated push prompts, stolen credentials and social engineering to bypass push-based authentication.

Why it matters: IAM and security teams need to treat push-only MFA as an approval-risk problem because repeated prompts can convert a valid login into account takeover.

Context

MFA fatigue attacks are an authentication control failure in which repeated push prompts train users to approve access without scrutiny. The weakness is not the cryptographic strength of MFA itself, but the decision model around one-tap approval and human exhaustion.

For IAM programmes, the issue sits at the boundary between identity proofing, authentication UX and account recovery. When an attacker already has valid credentials, the remaining control can become a behavioural pressure test rather than a reliable security check.

Key questions

Q: What breaks when organisations rely on MFA alone for digital interactions?

A: MFA can confirm the user once, but it does not automatically protect the active session or the transaction being approved later. Attackers can still hijack a session, manipulate a mobile workflow, or abuse a valid login to authorise a high-value action. Stronger assurance has to follow the interaction, not stop at the prompt.

Q: Why do stolen credentials make MFA bombing more effective than password theft alone?

A: Stolen credentials give attackers a valid starting point, which means the MFA prompt appears to come from a real login attempt. That makes the attack feel legitimate to the user and shifts the burden to human judgment. If the account also has excess privilege, one successful approval can expose far more data or systems than the login itself suggests.

Q: What are the signs that push-based MFA is being abused?

A: Look for repeated prompts, unusual login timing, multiple failed attempts followed by one success, and support calls that reference unexpected authentication requests. Those signals often indicate an attacker is trying to exhaust or confuse the user rather than break the factor directly. Monitoring should tie those events to account risk, not just authentication volume.

Q: Should organisations move from push MFA to phishing-resistant authenticators?

A: Yes, when users protect sensitive applications or are likely to face targeted social engineering. Phishing-resistant authenticators reduce dependence on user reaction during the authentication event, which is exactly where push fatigue attacks succeed. The goal is to remove the attacker’s ability to turn repeated prompts into a usable access path.

Technical breakdown

Why push approval becomes a weak trust signal

Push-based MFA relies on a simple human decision: approve or deny. That design is fast, but it also creates a predictable response channel that attackers can spam once they have a username and password. The control fails because it treats a prompt as evidence of user presence without enough context, rate control or phishing resistance. When prompts arrive in rapid succession, users are nudged from deliberate verification into reflexive approval. The authentication factor still exists, but the security meaning of the approval is degraded by repetition and fatigue.

Practical implication: treat one-tap push approval as a high-risk pattern unless it is paired with stronger anti-abuse controls.

How stolen credentials and social engineering combine

MFA fatigue attacks rarely start from scratch. Attackers first obtain valid credentials through phishing, credential stuffing or a third-party breach, then use repeated login attempts to trigger the push stream. Some campaigns add voice phishing or fake IT support calls to create urgency and legitimate the approval request. This is why the attack works so well: the prompt is not the only signal being manipulated, the surrounding context is too. The user is pushed to resolve a nuisance, not assess an authentication event.

Practical implication: monitor credential use and help desk interactions together, because the attack often spans both authentication and social engineering.

Why phishing-resistant MFA changes the control boundary

Phishing-resistant MFA shifts the trust decision from user reaction to cryptographic proof tied to a verified service and device. Passkeys, hardware security keys and identity-bound biometrics reduce the chance that an attacker can convert annoyance into approval, because there is no reusable prompt in the same sense. This changes the control boundary: authentication no longer depends on whether a human notices and resists a barrage of notifications. It depends on whether the legitimate user and service can complete a bound, verifiable exchange. That is a materially different security model.

Practical implication: prioritise phishing-resistant authentication for accounts where a single approval can expose critical systems or data.

Threat narrative

Attacker objective: The attacker wants authenticated access that looks legitimate enough to bypass normal login controls and open the path to privilege escalation.

1. Entry begins when attackers obtain valid credentials through phishing, credential stuffing or a third-party breach.
2. Escalation occurs when they trigger repeated MFA push requests and use timed social engineering to pressure the target into approval.
3. Impact follows when the approved session lets the attacker authenticate as the user, escalate privileges and move into downstream systems before detection.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Cisco Yanluowang breach 2022: A password synced to a personal Google account plus vishing and MFA fatigue opened Cisco's VPN; the attacker then abused machine accounts.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Push fatigue is an authentication governance failure, not just a user-behaviour issue. Push prompts were designed for convenience and speed, but that same design becomes brittle when the prompt is the security decision. The problem is not that users are careless by nature, it is that the control assumes sustained attention under pressure. The implication is that authentication governance must be measured against abuse resistance, not only adoption.

Approval-based MFA creates an identity signal that can be manufactured at scale. Once an attacker has valid credentials, the repeated-prompt loop becomes a low-cost method for converting noise into access. That changes the threat model for IAM teams because the control no longer fails at the credential stage, it fails at the decision stage. Organisations should treat this as a distinct authentication pattern with its own abuse surface.

Phishing-resistant MFA should be the default where account compromise has real blast radius. Passkeys, hardware security keys and identity-bound biometrics reduce the chance that a prompt can be socially engineered into consent. The important point is not that every environment can move at once, but that push-only MFA leaves too much security debt in places where attackers already know how to apply pressure.

Identity verification must be anchored in verified service, device and user presence, not notification volume. In practical terms, the security question is no longer whether a prompt was delivered, but whether the authentication event can be cryptographically tied to the legitimate service and actor. That is the control boundary modern IAM programmes need to defend.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Approval fatigue creates a governance gap between authentication success and genuine user intent. Teams that still rely on push-only MFA should assume attackers will keep exploiting the easiest path between credential theft and account takeover. The control question is no longer whether MFA exists, but whether the chosen factor can be coerced into approval.

Passkeys and hardware security keys shift the access decision away from repetitive prompts. That matters because the attack relies on making the user participate in the compromise. Once access is tied to a verified service and the real user presence, the prompt-spam model loses most of its leverage.

For practitioners

• Replace push-only approvals in high-risk apps Move privileged and sensitive applications away from simple approve or deny push prompts and toward phishing-resistant methods that require cryptographic proof of user presence.
• Rate-limit repeated authentication prompts Set hard limits on repeated MFA challenges so an attacker cannot convert notification spam into a successful approval sequence.
• Add context to every MFA prompt Show application name, device details and location in the approval flow so users can distinguish routine access from a suspicious challenge.
• Monitor for fatigue-pattern activity Alert on bursts of denied prompts, late-night approvals and unusual help desk contact that align with MFA pressure campaigns.
• Retire shared secrets from authentication paths Where possible, remove passwords and other reusable secrets from the access path so an attacker cannot pair stolen credentials with prompt abuse.

Key takeaways

• MFA fatigue attacks exploit the gap between a successful prompt and a genuine security decision, which is why push-only MFA is vulnerable at scale.
• The article cites real-world cases at Uber, Cisco and MGM Resorts to show that repeated prompts and social engineering can lead to full account compromise.
• Phishing-resistant authentication reduces the attack surface by removing the approval loop that attackers use to convert annoyance into access.

Key terms

• MFA Fatigue Attack: An MFA fatigue attack is a social engineering technique that bombards a user with repeated authentication prompts until they approve one out of annoyance, confusion, or urgency. The attacker usually starts with stolen credentials, then uses the approval flow itself to obtain access.
• Push-based MFA: A multi-factor method that sends an approve or deny notification to a device during login. It is convenient and fast, but that same convenience creates a behavioral weakness when users are asked to make repeated trust decisions.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.