MFA Security

🔒 MFA Fatigue Attacks: How Hackers Bypass Multi-Factor Authentication in 2026

By AY Tanoli, Security Researcher at Trusty Password · 20 September 2026 · 7 min read · 1,620 words

In September 2022, the attacker who breached Uber didn't crack a single password — they sent 37 MFA push notifications in under 20 minutes until a tired employee approved one. MFA fatigue (also called push bombing) is a cyberattack where an adversary who already holds your credentials floods your phone with authentication requests until you approve one by accident. It requires no malware, no zero-day exploit, and no technical sophistication — just your stolen password and a standard push-notification MFA setup.

How Push Bombing Works: Step by Step

Understanding the attack chain makes the defense obvious. Here is how a typical MFA fatigue attack unfolds:

1. Credential acquisition: The attacker obtains the victim's username and password. Sources include phishing, credential stuffing from previous data breaches, or purchasing credentials from dark-web markets. This step is why unique passwords matter — a password manager like NordPass eliminates reuse across accounts.
2. Login attempt: The attacker enters the correct credentials on the target service. The service sends an MFA push notification to the victim's registered device.
3. Push flooding: The attacker repeatedly initiates logins — sometimes dozens of times in quick succession — triggering a barrage of push notifications on the victim's phone.
4. Social engineering layer (optional): The attacker contacts the victim by phone or text, impersonating IT support, and says: "You may be seeing some authentication prompts — that's from our system upgrade, please approve the request." This is the technique used in the Uber and Caesars Entertainment breaches.
5. Victim approval: Worn down, confused, or deceived by the fake IT call, the victim taps "Approve." The attacker gains authenticated access.

Why MFA Fatigue Attacks Are Surging in 2026

Three converging factors have made push bombing the preferred technique of ransomware affiliates, nation-state actors, and cybercriminals in 2026:

• Credential glut: Over 15 billion stolen username-password pairs are actively circulating in criminal markets as of 2026, according to the SpyCloud 2026 Identity Exposure Report. Attackers can acquire working credentials for target organizations for under $50.
• Push MFA ubiquity: Legacy push-based MFA became the standard enterprise authentication upgrade in 2019–2023. Hundreds of millions of accounts depend on it — and most users were never trained on what an unexpected push request means.
• Automation toolkits: Off-the-shelf adversary-in-the-middle (AiTM) phishing kits and credential-stuffing platforms now include automated MFA push flooding as a built-in feature, reducing the technical skill required to launch attacks to near zero.

The NCSC (UK National Cyber Security Centre) Annual Review 2025 identified MFA fatigue as one of the three fastest-growing initial access techniques used against UK organisations, alongside AiTM phishing and AI-assisted spear phishing. The NCSC noted: "Organisations that rely solely on push-based MFA without number-matching or additional context should treat this as a critical control gap."

Real-World Breaches Caused by MFA Fatigue

NIST Special Publication 800-63B notes that push-based authenticators "shall incorporate additional controls to prevent automated attacks" — language that reflects the agency's recognition that vanilla push MFA is no longer sufficient against modern threat actors.

5 Warning Signs You Are Being Push-Bombed

1. Unexpected MFA notifications when you are not logging in. Any authentication push you did not initiate yourself means someone else has your password. Deny immediately and act.
2. Multiple rapid-fire requests. Two or more push notifications in quick succession is a push bombing signature. Legitimate services do not send repeat requests within seconds of a denial.
3. A follow-up call from "IT support." Real IT teams do not call you to ask you to approve an MFA prompt. This is the social engineering layer. Hang up and call your IT department on a number you find independently.
4. Push notifications at unusual hours. A 3 AM authentication request from your corporate VPN is not a coincidence — attackers often operate across time zones and target off-hours when users are groggy and less alert.
5. Notifications for a service you haven't used recently. A push from an account you haven't accessed in weeks suggests credential stuffing from a data breach is in progress.

How to Stop MFA Fatigue Attacks

For Individuals

• Enable number matching: Microsoft Authenticator, Google, and Duo now offer number-matching challenges — you must type a number shown on the login screen into the app, not just tap "Approve." This breaks automated push flooding entirely. Enable it in your authenticator app settings.
• Use a password manager with unique passwords everywhere: If attackers cannot obtain your password, they can never initiate the push. A dedicated password manager storing long, randomly generated credentials is your first line of defence. NordPass includes a built-in data breach scanner that alerts you the moment any of your stored passwords appear in a known breach.
• Add additional context to push notifications: Most modern authenticator apps can display the login location and device name. Enable this so you can immediately identify foreign logins.
• Set up MFA rate-limiting: Some services let you configure how many failed MFA attempts trigger a lock or alert. Check your account security settings and enable alerts for denied pushes.

For Organisations

• Mandate number-matching or additional context MFA: Microsoft, Okta, Duo, and Ping Identity all offer this feature. The deployment cost is a configuration change. The cost of not deploying it is measured in ransomware payouts.
• Implement push request throttling: Block accounts that trigger more than 3 MFA denials within 5 minutes and alert the security team. This simple rule would have stopped the Uber breach pattern in under 2 minutes.
• Train employees on MFA fatigue: Run simulated push bombing exercises. Employees who have experienced an unexpected push flood during a drill recognise it under real attack conditions.
• Enforce FIDO2/passkeys for privileged accounts: Admin, DevOps, finance, and HR accounts should use hardware-bound authenticators that are mathematically phishing-resistant.

Phishing-Resistant MFA: The Definitive Fix

MFA fatigue is a symptom of a specific design flaw: push-based MFA relies on human approval rather than cryptographic binding to the legitimate site. FIDO2/WebAuthn passkeys and hardware security keys (YubiKey, Google Titan) eliminate this flaw entirely.

The migration path for most organisations:

1. Short-term (this week): Enable number matching and additional context on all existing push-based MFA deployments.
2. Medium-term (3 months): Migrate privileged accounts to FIDO2 hardware keys. Issue YubiKeys to all administrators and executives.
3. Long-term (12 months): Roll out passkey authentication across all employee accounts. Major platforms (Microsoft, Google, GitHub, Okta) support passkeys natively in 2026.

For individuals, browser-native passkeys stored in your device's secure enclave (Face ID, Windows Hello, Android biometrics) are free, available now, and phishing-resistant by design. Enable passkeys on every service that offers them.

FAQs About MFA Fatigue Attacks

What is an MFA fatigue attack?

An MFA fatigue attack (also called push bombing) is a social engineering technique where an attacker who already has your password repeatedly sends multi-factor authentication push notifications to your phone, hoping you approve one out of frustration, confusion, or to stop the alerts. It requires no malware and exploits human psychology rather than technical vulnerabilities.

Does MFA fatigue work against all types of MFA?

No. MFA fatigue specifically targets push notification-based MFA. It does not work against FIDO2/passkeys, hardware security keys (YubiKey), or number-matching MFA because those methods require user action beyond a simple approval tap. Switching to phishing-resistant MFA eliminates this attack entirely.

How long do MFA fatigue attacks typically last?

Attacks can last from 10 minutes to several days. The Uber 2022 attack combined rapid push flooding with a WhatsApp social engineering message — the entire sequence took under 30 minutes. Some campaigns run low-rate overnight attempts hoping to catch a victim who approves a groggy 3 AM notification.

What should I do if I receive suspicious MFA push requests?

Deny every request immediately, then change your password and report the incident to your IT or security team. Each unexpected push notification means an attacker already has your current password — password rotation is mandatory even if you denied all requests. Monitor your accounts closely for the next 48 hours.

Can a password manager help prevent MFA fatigue attacks?

Yes — indirectly but critically. MFA fatigue requires the attacker to first possess your password. If every account uses a unique, randomly generated password stored in a password manager, credential stuffing and password reuse attacks fail before they start. No stolen password means no MFA prompt, and no prompt means no fatigue attack is possible.

Conclusion

MFA was the right answer to password theft. But push-based MFA introduced a new human vulnerability: approval fatigue. The attacks that breached Uber, Caesars, and MGM didn't crack encryption or exploit zero-days — they exploited the very human tendency to stop an annoying interruption by tapping a button.

The fix is not complicated. Enable number matching on your existing MFA apps today — it takes under two minutes. Then use a password manager with unique credentials everywhere so attackers can never reach your MFA prompt. For organisations, the migration to phishing-resistant FIDO2 authentication is no longer optional; it is the baseline CISA and NCSC expect in 2026.

Your MFA is only as strong as its weakest approval.