Multi-factor authentication bombing is an attack that overwhelms a user with repeated MFA prompts until they approve one by mistake. It targets push-based MFA and relies on prompt fatigue, so the control is to use number matching, rate limiting, device binding, and account lockout or alerting on repeated challenges.
What MFA bombing is and why it works
MFA bombing, also called push bombing or MFA fatigue, is an abuse of push-based sign-in prompts. The attacker is not breaking the second factor directly, they are trying to wear down the user until one approval slips through. That makes the weakness human and procedural, not just technical.
This matters because approval-based MFA assumes a person will reliably distinguish a real login from an attack. Once the user is trained to expect frequent prompts, the control can be turned into a nuisance that helps the attacker.
For a broader plain-English overview of second-factor choices and common misuse patterns, Two-Factor Authentication for Everyone Guide is a useful companion.
How attackers use prompt fatigue
Prompt fatigue works because it exploits interruption, habit and urgency. A user may be busy, distracted or assume the prompts are a glitch and eventually accept one without verifying the sign-in request. In some environments, the attacker pairs repeated prompts with password theft, social engineering or help desk pressure to increase the chance of success.
The attack is especially effective where push MFA is the default and users are not taught to reject unexpected prompts immediately. It is also more dangerous when legacy fallbacks, weak recovery paths or account reset processes give the attacker another route after one mistaken approval.
For readers comparing attack patterns and practical defenses, MFA Fatigue and Bypass Guide explains the surrounding abuse patterns in more depth.
Controls that reduce bombing risk
The most effective mitigation is to make approvals harder to fake and easier to reject. Number matching forces the user to confirm a code shown on the login screen, device binding ties prompts to a known device, and rate limiting reduces how many prompts can be generated in a short window. Alerting and temporary lockout after repeated failures can also interrupt the attack before the user is worn down.
Phishing-resistant authentication methods, such as security keys or passkeys, reduce reliance on user approval of a simple push. Where push MFA remains in use, organizations should treat repeated prompts as a security event, not only a usability issue.
The technical control choice is also a policy decision. Teams need to decide where push MFA is still acceptable, where stronger methods are required, and how to handle recovery without creating an easier bypass path.
For implementation detail on stronger authentication methods, NIST SP 800-63 Digital Identity Guidelines is the clearest external reference, and NHIMG’s Passwordless and Passkeys Guide shows how phishing-resistant sign-in changes the problem.
Detection, investigation and post-approval response
MFA bombing is often visible before account compromise if the organisation watches for repeated challenge spikes, unusual geolocation patterns, impossible travel, or a prompt burst that is not followed by normal user behaviour. Security teams should treat a sudden cluster of rejected or unanswered prompts as an early warning signal.
If a user approves an unexpected prompt, the incident should be handled like a likely account compromise. The right response is to revoke active sessions, reset the affected credential path, review recent authentication events, and check whether the attacker used the newly opened session to access email, admin tools or other sensitive systems.
Because the issue is often the first step in a larger compromise chain, post-incident review should also ask whether the same user had weak recovery options, overbroad access, or fallback authentication paths that made the attack more valuable.
For a real-world example of MFA fatigue leading to deeper compromise, Uber breach 2022 is directly relevant, and Microsoft Midnight Blizzard breach shows how weak or absent MFA around legacy access paths can still be exploited.
Risk and Threat Considerations
Multi-factor authentication bombing turns a defensive control into an access path by exploiting user fatigue and weak prompt handling. The main risk is not the prompt itself, but the chance that a legitimate user will eventually approve an attacker’s request under pressure or distraction.
Failure mechanism: Repeated push notifications desensitise the user, and one mistaken approval can create a valid authenticated session for the attacker.
Impact: The attacker can move from a single account compromise to mailbox access, application access, token theft or broader internal access if the approved session is trusted elsewhere.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Defines phishing-resistant authentication and authenticator assurance for this attack pattern |
| Recommendation — Use phishing-resistant authenticators and number matching to reduce prompt-approval abuse. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers authenticator lifecycle and protections relevant to MFA prompt abuse |
| IA-2 — Identification and Authentication (Organizational Users) | Directly governs user authentication controls that bombing attempts exploit | |
| Recommendation — Enforce strong authenticator management and limit repeated challenge generation. Require stronger user authentication methods and monitor repeated sign-in challenges. | ||
| MITRE ATT&CK | T1621 — Multi-Factor Authentication Request Generation | Names the technique used to overwhelm users with repeated MFA prompts |
| Recommendation — Map alerting and detections to MFA request generation and investigate prompt bursts. | ||
| OWASP ASVS | V6 — Authentication | Sets authentication requirements that help reduce weak MFA workflows and abuse |
| Recommendation — Verify authentication flows resist prompt fatigue and support phishing-resistant options. | ||
Practitioner Guidance
Why practitioners should care: This is one of the clearest examples of a control that fails through user exhaustion rather than cryptographic weakness. If your environment still relies on push approvals, the security outcome depends on how reliably people can recognise and reject unexpected prompts under stress.
Common misunderstanding: Treating any MFA as equivalent is a mistake. Push MFA can be materially weaker than phishing-resistant methods when users are routinely bombarded, and recovery or fallback workflows can quietly reintroduce the same exposure.
Practitioner takeaway: Prefer methods that reduce approval ambiguity, then watch repeated prompt activity as an incident signal rather than a routine authentication annoyance.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 9, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org