Unsolicited Authentication Request

What Makes an Unsolicited Authentication Request Dangerous

An unsolicited authentication request is dangerous because it turns a normal sign-in flow into an attacker-driven approval path. The user is not verifying a site or entering a password, they are being pushed to accept a login event that may already be in progress, which makes social pressure and alert fatigue part of the attack surface.

This pattern is especially effective when the organisation relies on push-based MFA or similar out-of-band approval prompts. A single mistaken approval can establish a session, and once that happens the attacker may never need the user’s password at all.

How Prompt Bombing Works

Prompt bombing, also called MFA fatigue, repeatedly sends login approvals until the user approves one or taps through the noise. The attacker may not need to compromise the password if the authentication factor itself can be socially engineered into granting access.

The pattern is often paired with credential stuffing, stolen passwords, or legacy access paths so the prompt arrives at the right moment. In a practical sense, the prompt becomes the last step in a broader intrusion chain rather than a reliable proof of intent.

For a deeper view of this attack pattern, see MFA Fatigue and Bypass Guide and the MITRE ATT&CK T1621 Multi-Factor Authentication Request Generation guide.

Why Push-Based Approval Is So Abusable

Push approval is convenient, but convenience can become a weakness when the prompt has no strong context, no number challenge, and no meaningful user verification. If users are trained to approve quickly, the control can degrade into a habit rather than a deliberate security decision.

The risk is not the push notification itself, but the trust decision it asks the user to make under pressure. That makes the control vulnerable to repeated prompts, help-desk confusion, and situations where the user assumes the request is a routine system event.

Controls that improve context, such as phishing-resistant authenticators and stricter approval UX, reduce the chance that an unsolicited prompt can be mistaken for a legitimate one. Workforce Identity Security Guide and Passwordless and Passkeys Guide both explain how stronger sign-in methods change that risk profile.

What Defenders Should Look For

Defenders should treat repeated, unexpected approvals as a sign of active abuse, not just user annoyance. A burst of denied prompts, approval requests at odd hours, or approvals followed by unfamiliar sign-ins can indicate that an attacker is testing whether the user will relent.

Post-approval compromise review matters because a successful prompt can expose sessions, tokens, access to internal tools, and sometimes related secrets or administrative paths. The review should look beyond the login event itself and ask what the attacker could do immediately after the approval was accepted.

For a broader defensive baseline, MFA Guide and NIST SP 800-63 Digital Identity Guidelines are useful references for stronger authentication design and phishing-resistant methods.

Risk and Threat Considerations

Unsolicited authentication requests create a direct abuse path from nuisance to account compromise. The threat is not limited to password theft, because the attacker is trying to get the user to create the access event for them.

Failure mechanism: The control depends on user recognition and refusal, so repeated prompts, timing pressure, or interface confusion can turn a legitimate second factor into an attacker-approved login.

Impact: A successful approval can give the attacker an active session, access to downstream systems, and a foothold for lateral movement or secret theft without ever learning the password.

Practitioner Guidance

Why practitioners should care: This term is a warning sign that authentication design is relying too heavily on user judgment at the moment of attack. Where prompt bombing is possible, the organisation should prefer methods that bind the sign-in to a specific device, context, or cryptographic proof rather than a simple yes-or-no tap.

What to watch for: Repeated approval prompts, user reports of “mystery” sign-in requests, and successful logins that follow a series of denied prompts are all indicators that the environment is being targeted. MFA Guide is a useful operational reference for choosing and hardening the right factor mix.

Related resources from NHI Mgmt Group

• Who is accountable when a user approves a malicious authentication request?
• Who is accountable when request smuggling affects authentication or session integrity?
• What breaks when a legacy application has no authentication enforcement in its request pipeline?
• What breaks when authentication provider selection is controlled by request parameters?