TL;DR: Repeated breaches tied to MFA fatigue, phishing, and social engineering show that mobile push approval is still easy to bypass, while phishing-resistant MFA uses asymmetric cryptography to make approval requests far harder to steal or manipulate, according to Axiad. The real issue is not adding another login factor but replacing trust assumptions that depend on user response under pressure.
At a glance
What this is: This is an analysis of why mobile push MFA is still bypassable and why phishing-resistant MFA changes the trust model by binding authentication to asymmetric cryptography rather than user approval.
Why it matters: It matters because IAM teams still treat MFA as a checkbox when the real control question is whether the factor can be socially engineered, fatigued, or replayed across human and non-human access paths.
Context
Phishing-resistant MFA is a control question, not a product category question. The issue is whether authentication depends on a user action that an attacker can pressure, repeat, or redirect until the user approves. In identity programmes, that gap matters across human login flows first, then across any access path that still relies on shared approval behaviour.
Axiad's article frames mobile push as convenient but weak against MFA fatigue and impersonation, while phishing-resistant methods remove the approval loop that attackers exploit. The underlying programme problem is the same one identity teams face elsewhere: controls built for cooperative users break when adversaries weaponise the interaction itself.
Key questions
Q: What breaks when organisations rely on mobile-based MFA in environments where phones are prohibited?
A: The access model breaks at the point of login, forcing teams into exceptions, workarounds, or weaker backup methods. That usually means more friction for employees, more password resets, and a larger attack surface from shared accounts or fallback codes. A better design keeps authentication native to the workstation or facility access point.
Q: Why do phishing-resistant MFA methods reduce account takeover risk more than codes or SMS?
A: They bind the credential to the legitimate domain, so a fake login page cannot capture a reusable secret. That prevents the attacker from replaying the factor on the real service, which is the key failure in most phishing campaigns. Codes and SMS may still help with friction, but they do not remove the replay problem.
Q: What are the warning signs that MFA fatigue is in progress?
A: Look for many MFA requests in a short time, repeated denials or cancellations, unusual access geography, and a successful approval after a burst of failures. Those signals show the attacker is probing the human decision loop rather than exploiting a technical flaw.
Q: How should organisations phase out legacy MFA for sensitive access?
A: Start with privileged users, supplier access, and systems tied to regulated or sensitive data. Replace SMS and push-based approval with phishing-resistant methods such as FIDO2/WebAuthn or PIV/CAC, then update access policies so the stronger method becomes the default for high-risk accounts.
Technical breakdown
Why mobile push MFA is vulnerable to fatigue and social engineering
Mobile push MFA works by sending a notification to a registered device and asking the user to approve the sign-in. That design is simple to deploy, but it assumes the user can reliably distinguish a legitimate request from an attacker-generated stream of prompts. MFA fatigue attacks exploit the human tendency to stop repeated interruptions, while impersonation of IT or help desk staff adds psychological pressure. The control therefore depends less on cryptography than on user judgment under stress, which is exactly what attackers target.
Practical implication: do not treat push approval as a strong phishing defence in high-risk access paths.
How phishing-resistant MFA changes the authentication trust model
Phishing-resistant MFA uses asymmetric cryptography so the authenticator and the relying party prove possession without exposing a reusable secret or relying on a user to approve a generic prompt. Methods such as FIDO/WebAuthn and PKI-based authentication bind the response to the origin and session context, which makes relay, replay, and push bombing ineffective in the same way. The important shift is that the attacker no longer gets a standing opportunity to coerce the user into authorising the action, because the assertion is not a manual yes/no response.
Practical implication: prioritise authentication flows that cryptographically bind the login to the legitimate origin and session.
Why authentication hardening must span people, devices, and operating systems
The article also points to a broader identity pattern: strong MFA only works consistently when it is applied across the different places users sign in, not as a siloed control on one application. If authentication is fragmented across devices, operating systems, and apps, attackers simply move to the weakest path. That is why phishing resistance is part of a wider identity architecture problem, not just a login-experience choice. The control has to be aligned with the full authentication surface, including the systems where users initiate access and the endpoints they use.
Practical implication: inventory all sign-in paths before assuming a single phishing-resistant method covers the estate.
Threat narrative
Attacker objective: The objective is to take over authenticated user sessions and use that access to reach internal applications and data without having to steal a password outright.
- Entry occurs when the attacker obtains a target's attention through repeated MFA prompts or a believable help desk pretext tied to the sign-in event.
- Credential use is attempted through the approval channel, where the attacker relies on the victim to satisfy the authentication challenge on their behalf.
- Impact follows when the attacker gains account access after the user approves a fraudulent prompt or otherwise satisfies the weak MFA flow.
Breaches seen in the wild
- Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Phishing-resistant MFA is really a trust-assumption fix, not a factor-count upgrade. Mobile push and similar approval-based methods still assume the user can safely judge a request at the moment it arrives. That assumption fails under fatigue, pretexting, and repeated interruption. The practitioner conclusion is that MFA strength depends on whether the factor resists manipulation, not on how many factors are present.
Approval-driven authentication creates a human decision point that attackers can operationalise. Once a prompt can be generated, repeated, or socially engineered, the control boundary has shifted from cryptography to user behaviour. That is why phishing-resistant methods matter: they remove the interactive approval channel from the attacker's playbook. The practitioner conclusion is that high-risk access should not depend on a person under pressure saying yes.
The identity attack surface is the real control boundary, not the app being protected. A weak factor on a single sign-in path can undermine the whole programme if other paths still allow push or OTP-style approval. This is where fragmented authentication architectures create governance debt. The practitioner conclusion is that phishing resistance has to be evaluated across the full access estate, not per application in isolation.
Identity teams should treat phishing-resistant MFA as part of broader session and lifecycle governance. A hardened authenticator still leaves policy, device trust, and recovery paths to manage, especially where users move between applications, devices, and operating systems. The article's broader signal is that identity security fails when controls are deployed as isolated features instead of governed lifecycle components. The practitioner conclusion is to align authentication policy with the rest of the identity programme.
Identity attack surface: The article makes clear that the decisive risk is not only password theft but the ability to coerce an approval event inside the authentication flow. That problem spans human identity today and any future access path that still relies on interactive confirmation. The practitioner conclusion is to measure how much of the estate still depends on user approval rather than cryptographic proof.
From our research library:
- 1 in 3 organisations encountered suspicious AI agent activity in 2025, and 99.4% experienced a SaaS or AI ecosystem incident.
What this signals
Approval-based MFA is now a governance problem, not just an authentication problem. If a sign-in flow can be exhausted, coerced, or socially engineered, the control is only as good as the user under pressure. Identity programmes should therefore measure how much of their access estate still depends on human response instead of cryptographic proof.
Phishing-resistant authentication changes the centre of gravity for IAM teams. The practical question is no longer whether users can complete MFA, but whether the factor can be manipulated by an attacker who controls the timing and volume of prompts. That is a programme design issue, not a help desk annoyance.
For practitioners
- Migrate high-risk sign-ins to phishing-resistant MFA Replace push approval on privileged, administrative, and remote access paths with FIDO/WebAuthn or PKI-based methods that do not rely on a simple approve or deny response.
- Map every authentication path, not just the main app login Inventory devices, operating systems, remote access channels, and application-specific sign-ins to find where push, OTP, or other approval-based flows still exist.
- Reduce the value of MFA prompts as an attack surface Tune help desk procedures, user guidance, and alerting so repeated prompts are treated as suspicious behaviour rather than a nuisance to be cleared.
- Align authentication recovery with stronger assurance Review reset, fallback, and account recovery paths so a phishing-resistant primary factor is not undercut by weaker recovery controls.
Key takeaways
- Push-based MFA can be bypassed when attackers exploit human fatigue or impersonation to win an approval prompt.
- Phishing-resistant MFA shifts trust from user reaction to cryptographic proof, which removes the attacker’s easiest path.
- Identity teams should treat authentication method choice as an enterprise control decision across the full access surface, not a single sign-in preference.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article is about MFA methods that remain vulnerable to social engineering and prompt abuse. |
| Recommendation — Replace approval-based MFA on high-risk access paths with phishing-resistant authentication. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | The article centres on authentication strength and phishing resistance for identity assurance. |
| Recommendation — Use authentication methods that resist phishing, replay, and approval coercion. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | MFA choice affects how access is granted and verified across the identity programme. |
| Recommendation — Align access verification methods with the sensitivity of the protected resources. | ||
| MITRE ATT&CK | TA0006 — Credential Access | MFA fatigue and phishing are part of the credential access path used in the cited attacks. |
| Recommendation — Map MFA fatigue and phishing activity to credential access detections and user-reporting triggers. | ||
Key terms
- Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
- MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.
- Push approval authentication: An MFA method where a sign-in request is sent to a registered device and the user confirms it with a simple approve or deny action. It is convenient, but it creates a human decision point that can be manipulated through repeated prompts or impersonation.
- Asymmetric Encryption: A cryptographic method that uses a public key to share or verify information and a private key to decrypt or sign. It reduces key duplication and is often better suited to identity proofing because the private key can remain tightly controlled.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 12, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org