Topic starter
12/06/2026 10:13 pm
TL;DR: MFA fatigue attacks flood users with push prompts until one is approved, and Axiad cites Expel data showing 80% of successful business account compromise attacks already occurred in environments with MFA. The real weakness is not MFA itself but push-based trust that assumes users can reliably separate legitimate requests from attacker-driven noise.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “The Growing Problem with MFA Fatigue Attacks (And What You Can Do About It)”.
By the numbers:
- 80% of successful business account compromise attacks occurred in environments with MFA in place.
Key questions
Q: What breaks when push-based MFA is exposed to repeated notification attacks?
A: The control breaks when approval becomes automatic instead of deliberate.
Q: Why do MFA fatigue attacks still work when MFA is already deployed?
A: They work because MFA often assumes a legitimate user will distinguish a real prompt from an attacker-generated one.
Q: What are the signs that push-based MFA is being abused?
A: Look for repeated prompts, unusual login timing, multiple failed attempts followed by one success, and support calls that reference unexpected authentication requests.
Practitioner guidance
- Reduce MFA request volume Rate-limit repeated push requests, add lockouts after suspicious retry patterns, and alert on bursts that suggest prompt bombing rather than normal user behaviour.
- Adopt phishing-resistant authenticators Prioritise public key-based authenticators for employees who access sensitive systems, so authentication does not depend on users approving noisy prompts.
- Tighten step-up authentication for sensitive apps Require additional verification when users request access to high-value applications, especially after device changes, location changes, or unusual session behaviour.
Bottom line: MFA fatigue attacks exploit the human approval step, not the cryptography behind MFA, which is why repeated prompts can still lead to account compromise.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:50 am
Push fatigue is a governance problem, not just a user-awareness problem. The control failure begins when organisations rely on the user to be the final filter between a legitimate prompt and an attacker-generated prompt stream. That design assumes the user can preserve signal detection under repetition, which is not a safe security assumption. The implication is that MFA policy has to be judged by how much attacker-driven noise it tolerates before the control breaks.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations move from push MFA to phishing-resistant authenticators?
A: Yes, when users protect sensitive applications or are likely to face targeted social engineering. Phishing-resistant authenticators reduce dependence on user reaction during the authentication event, which is exactly where push fatigue attacks succeed. The goal is to remove the attacker’s ability to turn repeated prompts into a usable access path.
👉 Read our full editorial: MFA fatigue attacks expose the limits of push-based MFA
This post was modified 6 days ago by NHI Mgmt Group