Multi-factor authentication (MFA) is a well-known and effective measure of protecting access to user accounts. MFA helps to reduce the number of attacks associated with stolen login data. Due to the use of two or more different authentication factors, it’s almost impossible to access the account even if an attacker has the user’s login and password. However, attackers constantly find new ways to bypass two-factor authentication, often exploiting human factors. One of such new growing threats based on human factor is the MFA fatigue attack. Let’s explore what an MFA fatigue attack is and how to counter it. What Is an MFA Fatigue Attack? An MFA fatigue attack is a type of social engineering technique in which an attacker repeatedly triggers authentication requests, typically through push-based MFA, in order to overwhelm the user. MFA fatigue attacks are also called MFA bombing, MFA push bombing, MFA prompt bombing, or MFA push spam. The main goal of this type of attack is not to steal a one-time password, but to make the user approve a login request themselves. In this scenario, the attacker already has valid credentials (a username and password). Instead of attempting to bypass MFA technically, they rely on persistence, timing, and psychological pressure to gain access. This makes MFA fatigue fundamentally different from classic MFA bypass techniques such as phishing, brute force, keyloggers, man-in-the-middle, or SMS interception. How MFA Fatigue Attacks Work? A typical step-by-step breakdown of an MFA fatigue attack looks like this: Credential compromise. The attacker obtains a valid username and password, often through techniques such as phishing, credential leaks, or malware. Repeated login attempts. The attacker initiates multiple login attempts that trigger MFA push notifications. Notification overload. The victim receives dozens of unexpected approval requests within a short period of time. Accidental approval. Due to fatigue, distraction, or confusion, the user taps “Approve” or “Yes” just to stop the notifications. Successful access. The attacker gains legitimate access, with logs showing a valid MFA-approved session. Why Push-Based MFA Is Vulnerable to MFA Fatigue? Push-based MFA is popular because of its convenience. A single tap is often all that’s required to complete authentication. However, this low friction also introduces risk. Push notifications often: Provide little context about the login attempt; Can be triggered repeatedly without meaningful limits; Rely entirely on user judgment at the moment of approval....