How do attackers use multi-factor authentication request generation?

How attackers turn MFA request generation into a usable access path

Attackers use MFA request generation, often called push bombing or MFA fatigue, to convert a valid login into repeated approval prompts. The goal is not to defeat the second factor cryptographically, but to pressure the user into approving a prompt they did not initiate. When paired with stolen passwords or a live phishing session, it becomes a practical account takeover path rather than a nuisance event.

The technique works best when the victim has a permissive authenticator workflow, unclear alerting, or a habit of approving prompts reflexively. That is why prompt abuse is frequently seen alongside real-time phishing: the attacker first gets the username and password, then uses the flood of prompts to finish the sign-in before the victim understands what is happening.

For a deeper overview of how fatigue, relay, and token theft fit into MFA bypass patterns, see MFA Guide.

Why approval fatigue is effective against human verification

Prompt generation exploits a human decision point, not a protocol weakness. If the user can approve a login from a phone notification with little context, repeated prompts create confusion, urgency, or annoyance until one approval slips through. The attacker does not need every request to work, only one mistaken acceptance.

This is why number matching and phishing-resistant authenticators matter. They add context to the approval step and make a blind tap much harder to turn into access. In environments that still rely on basic push approvals, the control is often weaker than teams assume because it depends on the user noticing that the prompt is unexpected and refusing it under pressure.

For a control-oriented comparison of stronger and weaker MFA methods, the MFA Fatigue and Bypass Guide explains the common bypass patterns and the defences that reduce prompt abuse.

For a standards-based view of phishing-resistant authentication and authenticator assurance, NIST SP 800-63 Digital Identity Guidelines is the most relevant external reference.

What defenders should watch when MFA prompts are being abused

Repeated denied prompts, a sudden spike in MFA challenges for one account, and prompt activity from unusual locations or at odd hours are all warning signs. The pattern matters because it often indicates that the attacker already has the primary credential and is trying to force a social-engineering endgame rather than brute-forcing the password itself.

Prompt generation also becomes more dangerous when the same account is used for email, VPN, or admin access. Once the attacker gets one approval, the next steps are usually session hijacking, mailbox access, or privilege escalation through whatever trusted path the account already opens. That is why repeated prompt events should be treated as an access compromise signal, not just an authentication annoyance.

For incident patterns where stolen credentials and MFA abuse led directly to broader compromise, Uber breach 2022 and Cisco Yanluowang breach 2022 are useful references.

Risk and Threat Considerations

Repeated MFA requests can become a direct compromise path when the attacker already controls the password or a live session. The risk is highest where the approval workflow is easy to dismiss mechanically, because the attacker needs only one mistaken acceptance to convert noise into authenticated access.

Failure mechanism: The attacker floods the user with approval prompts until fatigue, confusion, or routine behavior causes an approval, then uses that approval to complete sign-in and pivot into the account or downstream systems.

Impact: Account takeover can follow even though the MFA system itself was not technically broken, and the attacker may then access mail, SaaS tools, VPN, or administrative consoles with the victim's trust already in place.

Practitioner Guidance

What to verify: Confirm whether your MFA product supports number matching, number challenge, or a phishing-resistant factor such as passkeys or security keys. If it still allows simple approve/deny pushes without context, treat prompt generation as a live takeover risk rather than a minor user-experience issue.

Decision rule: If you see repeated denied prompts for the same user, assume the primary credential may already be exposed and investigate the account immediately. If the user eventually approved one of the prompts, prioritize session review, token revocation, and password reset over waiting for stronger proof of abuse.

What good looks like: Users can distinguish legitimate from illegitimate prompts at a glance, repeated challenge bursts are rate-limited and alerted on, and sign-in events are traceable enough to show whether the prompt sequence was followed by mailbox, VPN, or admin activity.

Practitioner takeaway: MFA request generation is dangerous because it weaponises user fatigue against a legitimate control, so the defensive priority is to make approval harder to spoof, easier to detect, and less useful after the first suspicious prompt.

Related resources from NHI Mgmt Group

• Why do attackers use WhatsApp or other chat redirects to bypass multi-factor authentication on social accounts?
• Multi-Factor Authentication Request Generation
• How should security teams use fingerprint verification in multi-factor authentication without creating weak fallback paths?
• How should security teams use one-time passwords as part of multi-factor authentication without creating avoidable friction?