Multi-factor authentication (MFA) is a cornerstone of modern cybersecurity, designed to add a critical layer of protection beyond a simple password. Yet, attackers are resourceful, and they've found a way to turn one of MFA's most convenient features—the push notification—into a weapon. This method, known as an MFA fatigue attack or prompt bombing, exploits human psychology rather than technical vulnerabilities to bypass security controls. This article explores why these attacks are so effective and what you can do to build a more resilient defense against them.
The Problem: How MFA Fatigue Exploits the Human Element
An MFA fatigue attack is a type of social engineering attack that begins after an attacker has already obtained a user's valid credentials, often through phishing or a data breach. With the username and password in hand, the attacker's only remaining obstacle is the second factor of authentication. This is where the "fatigue" comes in.
The attacker uses an automated script to trigger login attempts over and over again, sometimes hundreds of times. Each attempt sends a push notification to the user's authentication app, flooding their device with approval requests.
Think of it like a relentless telemarketer who won't stop calling. Eventually, you might answer just to make it stop. Attackers bet on the same outcome. They overwhelm the user, hoping for one of three results:
- Accidental Approval: The user, trying to dismiss the constant notifications, accidentally taps "Approve."
- Frustration: Annoyed by the disruption, the user approves the request to silence the alerts, perhaps assuming it's a system glitch.
- Confusion: The user doesn't understand why they are receiving so many prompts and may approve one, thinking it will resolve a technical issue.
These attacks are particularly effective when launched during off-hours, like overnight or on a weekend, when a user is less likely to be vigilant. High-profile breaches, such as the one at Cisco in 2022, have demonstrated the real-world success of this technique, where attackers bombarded an employee with push notifications until they finally gained access.
The core of an MFA fatigue attack isn't about breaking encryption or finding a software flaw. It's about wearing down a person until they make a mistake. It weaponizes convenience and exploits our natural response to digital noise.
Why Standard Two-Factor Authentication Isn't Enough
The rise of MFA fatigue highlights a critical truth: not all MFA methods are created equal. While any MFA is better than none, a basic push notification that only asks for "Approve" or "Deny" lacks the necessary context to help a user make an informed security decision. When a user receives a prompt, they often can't see important details like where the login attempt is coming from or what device is being used.
This lack of context is what attackers rely on. Without it, the user is left to guess whether the request is legitimate. When dozens of these context-free requests arrive in minutes, the security value of the prompt diminishes rapidly. The system is working as designed, but the human operator is being manipulated.
Furthermore, MFA fatigue is just one of several bypass techniques. Attackers also use methods like:
- Session Hijacking: Stealing an authenticated session cookie from a user's browser to gain access without needing to authenticate again.
- IT Support Impersonation: Calling a user, pretending to be from the help desk, and tricking them into reading out a one-time passcode (OTP) or approving a login.
These methods prove that simply having a second factor isn't a silver bullet. Your defense needs to be more intelligent and layered.
The Solution: Building a Resilient Defense Against MFA Fatigue
Defending against MFA fatigue requires a multi-pronged approach that hardens your technical controls, enhances visibility, and empowers your users. You can't just set up MFA and forget it; you need to optimize it for today's threat landscape.
Strengthen Your MFA Implementation
The most direct way to combat prompt bombing is to make your MFA method itself more robust.
Phishing-Resistant MFA
Move away from easily phished or spammed methods. Phishing-resistant authenticators are the gold standard because they can't be easily tricked or fatigued. Examples include:
- FIDO2 Security Keys: Physical hardware keys (like a YubiKey) that require a physical touch or biometric input to authenticate.
- Biometrics: Using fingerprints or facial recognition built into devices.
Number Matching
A simple but highly effective defense is number matching. When a user logs in, they see a number on the login screen. The authentication app then prompts them to enter that same number to approve the request. This forces active participation and makes it nearly impossible to approve a request by accident.
Rate Limiting and Lockouts
Configure your identity provider to limit the number of MFA requests that can be sent in a short period. For example, you can set a policy to lock an account for several minutes after three consecutive denied or ignored MFA prompts. This stops an attacker's automated script in its tracks.
Enhance Visibility with Context and Analytics
If an attacker is attempting to bypass your controls, you need to be able to see it happening. This is where context and analytics become critical.
Adaptive and Risk-Based Authentication
Instead of challenging every login with MFA, use an adaptive policy that evaluates the risk of each attempt. This approach analyzes contextual signals to determine if a login is legitimate. These signals can include:
- Geolocation: Is the login coming from a known or expected location?
- Device Fingerprint: Is the user on a trusted, corporate-managed device?
- IP Reputation: Is the request coming from a known malicious IP address or an anonymous proxy?
- Time of Day: Is the login occurring at a normal time for this user?
High-risk logins (e.g., from an unknown device in a different country) can trigger a mandatory MFA challenge, while low-risk logins (e.g., from a corporate laptop in the office) can proceed without interruption.
Behavioral Analytics (UEBA)
User and Entity Behavior Analytics (UEBA) platforms monitor for abnormal activity by establishing a baseline of normal user behavior. A UEBA system can automatically detect anomalies that signal an MFA fatigue attack, such as:
- An unusually high volume of MFA requests for a single user.
- Login attempts from geographically impossible locations in a short time frame ("impossible travel").
- A user suddenly accessing applications they've never used before.
These systems can automatically flag the suspicious behavior for your security team or even trigger an automated response, like temporarily disabling the account.
Empower Your Users
Your employees are your last line of defense, so they need to be prepared.
Security Awareness Training
Train users to recognize the signs of an MFA fatigue attack. They should know that a flood of unexpected authentication requests is a red flag, not a technical glitch. Teach them to always deny suspicious prompts and immediately report them.
Provide Clear Reporting Channels
Make it easy for users to report a suspected attack. A simple "Report Suspicious Activity" button within the authentication app or a dedicated email address for the security team can make all the difference. Fast reporting allows your team to investigate and neutralize the threat before a compromise occurs.
How Material Security Addresses Identity-Based Threats
Even with the best defenses, determined attackers may still find a way in. That's why security can't stop at the point of login. It's crucial to have protections in place for what attackers are after: your data.
Platforms like Material Security are designed to provide this essential layer of defense for cloud environments like Microsoft 365 and Google Workspace. While traditional security focuses on the perimeter, Material secures the data itself. The platform's identity threat detection capabilities can identify suspicious login behaviors and access patterns that indicate a compromised account, whether from MFA fatigue or another bypass technique.
If an account is breached, Material Security can automatically discover and redact sensitive data in compromised mailboxes and files, preventing data theft. By combining identity protection with data security, you create a defense-in-depth strategy that protects your organization even if an attacker manages to slip past your initial authentication controls.
Conclusion
MFA fatigue attacks are a stark reminder that security is an ongoing process, not a one-time setup. It's time to review your organization's approach to authentication.
- Evaluate your current MFA solution: Are you relying solely on basic push notifications? Consider upgrading to phishing-resistant methods or enabling features like number matching.
- Assess your visibility: Can you detect a high volume of MFA requests or other anomalous login behaviors? If not, explore solutions that offer adaptive authentication and UEBA.
- Strengthen your data security posture: Assume a breach will happen. Ensure you have controls in place to protect your most sensitive data within your cloud office suite.
To learn more about building a resilient security posture for your cloud environment, explore how Material Security provides a comprehensive detection and response platform for Microsoft 365 and Google Workspace.
.png)