Topic starter
02/08/2026 11:28 am
TL;DR: MFA fatigue attacks work by flooding users with repeated push prompts until one is approved, turning valid passwords into account access and often leading to rapid follow-on persistence actions, according to Prophet. The real failure is not authentication strength alone, but the human approval loop that permissive MFA designs still depend on.
Editorial analysis by NHI Mgmt Group, based on content published by Prophet: “How MFA Fatigue Attack Works and How to Fight Back”.
Key questions
Q: What breaks when push MFA depends on blind approvals?
A: Push MFA breaks when users are asked to approve requests without enough context to verify the session behind them.
A: MFA fatigue works because attackers exploit routine behavior, not just technical weakness.
Q: What signals show that an MFA fatigue attack is underway?
A: Look for repeated MFA requests in a short period, a long series of denials, and then one unexpected approval.
Practitioner guidance
- Harden push approvals with phishing-resistant factors Require FIDO2 security keys or passkeys for high-value accounts and administrative paths so access is not decided by a single approve or deny prompt.
- Enable number matching everywhere it is supported Turn on number matching in the authenticator stack and verify that legacy tenants, fallback flows, and special-case apps are not still using simple push approval.
- Rate-limit repeated MFA prompts Cap prompt frequency per user and suspend push after repeated failures so a live prompt flood cannot continue until one approval lands.
Bottom line: MFA fatigue attacks exploit the user decision step in push-based MFA, which means the failure can exist even when passwords and factors are technically valid.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:44 pm
MFA fatigue is an approval-loop failure, not an authentication-strength failure: The password and second factor can both be technically valid while the human approval process is still coerced into granting access. That distinction matters because many programmes measure MFA coverage without measuring whether the approval model itself can be manipulated. The right question is not whether MFA exists, but whether an attacker can weaponise its human confirmation step. The practitioner conclusion is that permissive approval flows are part of the attack surface.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations keep approve or deny push prompts for high-value accounts?
A: Not for critical access. Approve or deny push is easy to abuse because it places the final security decision in a human response that attackers can pressure. For privileged or sensitive accounts, phishing-resistant MFA and tighter conditional access provide a more defensible control posture.
👉 Read our full editorial: MFA fatigue attacks exploit human approval loops, not crypto