A social engineering tactic that overwhelms a user with repeated authentication prompts until they approve one by mistake or out of frustration. It does not usually defeat the authenticator itself. Instead, it exploits human behaviour and weak notification design to convert a legitimate login flow into an access bypass.
Expanded Definition
MFA bombing, also called mfa fatigue or push fatigue, is a form of authentication abuse that targets the person approving the prompt rather than the authenticator itself. The attacker typically already has a password, session token, or another foothold, then generates repeated approval requests until the user accepts one out of confusion, inconvenience, or a desire to stop the notifications. In NHI and IAM environments, the tactic matters because it turns a legitimate control into a human override channel.
Definitions vary across vendors, but the core pattern is consistent: the access path is not “broken,” it is socially manipulated. This is why modern guidance increasingly treats MFA as one layer in a broader control stack that also includes device binding, number matching, conditional access, and phishing-resistant authenticators. NIST’s NIST Cybersecurity Framework 2.0 reinforces that access controls must be resilient, monitored, and continuously improved rather than assumed safe by default.
The most common misapplication is treating every unexpected approval as a benign user mistake, which occurs when teams lack alerting, prompt limits, and escalation paths for repeated authentication events.
Examples and Use Cases
Implementing MFA rigorously often introduces more user friction and support overhead, requiring organisations to weigh stronger verification against the risk of prompting users too often.
- A remote attacker who stole a password sends dozens of push requests in a short window, hoping the target approves one just to regain device quiet.
- A help desk user receives a prompt while in a meeting, assumes it is tied to a legitimate login, and approves without checking the source.
- In a cloud account takeover, the attacker uses MFA bombing to validate access after password reuse, then pivots into email, storage, or admin consoles.
- Security teams use repeated-prompt detection, geographic mismatch alerts, and number matching to reduce approval-by-fatigue risk.
- After incidents such as the Microsoft Midnight Blizzard breach, organisations often reassess whether their MFA flow can be coerced by repeated prompts rather than truly resisted.
Phishing-resistant methods described in NIST identity guidance are often preferred for high-risk accounts, while NIST Cybersecurity Framework 2.0 supports continuous monitoring and response when authentication patterns become abnormal.
Why It Matters in NHI Security
MFA bombing is important in NHI security because the same behavioural weakness that affects human users also shows up in admin workflows, shared access paths, and approval-heavy identity systems that support NHIs. If a compromised operator account can be tricked into approval, the attacker may reach secrets, automation consoles, or privileged service management interfaces that underpin NHI estates. That is especially serious when organisations already struggle with lifecycle control and visibility. NHI Mgmt Group reports that only 5.7% of organisations have full visibility into their service accounts, and 97% of NHIs carry excessive privileges, which means a single coerced approval can expose far more than one user session.
This risk is amplified when secrets and service credentials are tied to interactive access workflows instead of being isolated under strong policy. The broader lesson is that MFA should not be treated as a one-click shield; it needs anti-fatigue design, alerting, and step-up controls. For related NHI context, see the Ultimate Guide to Non-Human Identities and the Microsoft Midnight Blizzard breach.
Organisations typically encounter the operational damage only after a user has approved a fraudulent prompt and the attacker has already moved into email, cloud, or secrets access, at which point MFA bombing becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Repeated MFA prompts can enable account takeover despite valid credentials. |
| OWASP Agentic AI Top 10 | A-04 | Authentication workflows for agents need resilience against prompt abuse and coercion. |
| NIST CSF 2.0 | PR.AC-7 | Access control should enforce authenticated, monitored, and resilient user verification. |
| NIST SP 800-63 | AAL2 | MFA bombing targets weaker push-based MFA, not the authenticator itself. |
| NIST Zero Trust (SP 800-207) | SA | Zero Trust requires continuous verification instead of trusting a single approval event. |
Prefer stronger authenticator assurance and use resistance features beyond simple push approval.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
