Topic starter
24/06/2026 8:39 pm
TL;DR: MFA fatigue attacks exploit repeated push prompts, stolen credentials, and help desk social engineering to turn one approval into full account compromise, with real-world breaches at Uber, Cisco, and MGM Resorts showing the pattern repeatedly, according to 1Kosmos. Push-based MFA stops looking resilient once attackers can convert user exhaustion into authentication success.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “MFA Fatigue Attack: Definition & Prevention Tactics”.
Key questions
Q: What breaks when organisations rely on MFA alone for digital interactions?
A: MFA can confirm the user once, but it does not automatically protect the active session or the transaction being approved later.
Q: Why do stolen credentials make MFA bombing more effective than password theft alone?
A: Stolen credentials give attackers a valid starting point, which means the MFA prompt appears to come from a real login attempt.
Q: What are the signs that push-based MFA is being abused?
A: Look for repeated prompts, unusual login timing, multiple failed attempts followed by one success, and support calls that reference unexpected authentication requests.
Practitioner guidance
- Replace push-only approvals in high-risk apps Move privileged and sensitive applications away from simple approve or deny push prompts and toward phishing-resistant methods that require cryptographic proof of user presence.
- Rate-limit repeated authentication prompts Set hard limits on repeated MFA challenges so an attacker cannot convert notification spam into a successful approval sequence.
- Add context to every MFA prompt Show application name, device details and location in the approval flow so users can distinguish routine access from a suspicious challenge.
Bottom line: MFA fatigue attacks exploit the gap between a successful prompt and a genuine security decision, which is why push-only MFA is vulnerable at scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:22 am
Push fatigue is an authentication governance failure, not just a user-behaviour issue. Push prompts were designed for convenience and speed, but that same design becomes brittle when the prompt is the security decision. The problem is not that users are careless by nature, it is that the control assumes sustained attention under pressure. The implication is that authentication governance must be measured against abuse resistance, not only adoption.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations move from push MFA to phishing-resistant authenticators?
A: Yes, when users protect sensitive applications or are likely to face targeted social engineering. Phishing-resistant authenticators reduce dependence on user reaction during the authentication event, which is exactly where push fatigue attacks succeed. The goal is to remove the attacker’s ability to turn repeated prompts into a usable access path.
👉 Read our full editorial: MFA fatigue attacks expose the limits of push-based authentication