Topic starter
24/06/2026 8:39 pm
TL;DR: MFA fatigue attacks can turn repeated prompts and social engineering into account compromise, according to 1Kosmos. Push-based MFA leaves the approval moment exposed to exhaustion and mistaken trust.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “MFA Fatigue Attack: Definition & Prevention Tactics”.
Key questions
Q: Why do stolen credentials make MFA bombing more effective than password theft alone?
A: Stolen credentials give attackers a valid starting point, which means the MFA prompt appears to come from a real login attempt.
Q: What are the signs that push-based MFA is being abused?
A: Look for repeated prompts, unusual login timing, multiple failed attempts followed by one success, and support calls that reference unexpected authentication requests.
Q: What breaks when organisations rely on MFA alone for digital interactions?
A: MFA can confirm the user once, but it does not automatically protect the active session or the transaction being approved later.
Practitioner guidance
- Replace push-only approvals in high-risk apps Move privileged and sensitive applications away from simple approve or deny push prompts and toward phishing-resistant methods that require cryptographic proof of user presence.
- Rate-limit repeated authentication prompts Set hard limits on repeated MFA challenges so an attacker cannot convert notification spam into a successful approval sequence.
- Add context to every MFA prompt Show application name, device details and location in the approval flow so users can distinguish routine access from a suspicious challenge.
Bottom line: MFA fatigue attacks exploit the gap between a successful prompt and a genuine security decision, which is why push-only MFA is vulnerable at scale.
Glossary terms: MFA Fatigue Attack, Push-based MFA, Phishing-Resistant Authentication, Credential Stuffing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
25/06/2026 5:22 am
Push fatigue is an authentication governance failure, not just a user-behaviour issue. Push prompts were designed for convenience and speed, but that same design becomes brittle when the prompt is the security decision. The problem is not that users are careless by nature, it is that the control assumes sustained attention under pressure. The implication is that authentication governance must be measured against abuse resistance, not only adoption.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations move from push MFA to phishing-resistant authenticators?
A: Yes, when users protect sensitive applications or are likely to face targeted social engineering. Phishing-resistant authenticators reduce dependence on user reaction during the authentication event, which is exactly where push fatigue attacks succeed. The goal is to remove the attacker’s ability to turn repeated prompts into a usable access path.
👉 Read our full editorial: Push-based MFA fails when approval fatigue becomes the attack path
This post was modified 17 hours ago by NHI Mgmt Group