Multi-factor authentication (MFA) is a well-known and effective measure of protecting access to user accounts. MFA helps to reduce the number of attacks associated with stolen login data. Due to the use of two or more different authentication factors, it’s almost impossible to access the account even if an attacker has the user’s login and password. However, attackers constantly find new ways to bypass two-factor authentication, often exploiting human factors. One of such new growing threats based on human factor is the MFA fatigue attack. Let’s explore what an MFA fatigue attack is and how to counter it. What Is an MFA Fatigue Attack? An MFA fatigue attack is a type of social engineering technique in which an attacker repeatedly triggers authentication requests, typically through push-based MFA, in order to overwhelm the user. MFA fatigue attacks are also called MFA bombing, MFA push bombing, MFA prompt bombing, or MFA push spam. The main goal of this type of attack is not to steal a one-time password, but to make the user approve a login request themselves. In this scenario, the attacker already has valid credentials (a username and password). Instead of attempting to bypass MFA technically, they rely on persistence, timing, and psychological pressure to gain access. This makes MFA fatigue fundamentally different from classic MFA bypass techniques such as phishing, brute force, keyloggers, man-in-the-middle, or SMS interception. How MFA Fatigue Attacks Work? A typical step-by-step breakdown of an MFA fatigue attack looks like this: Credential compromise. The attacker obtains a valid username and password, often through techniques such as phishing, credential leaks, or malware. Repeated login attempts. The attacker initiates multiple login attempts that trigger MFA push notifications. Notification overload. The victim receives dozens of unexpected approval requests within a short period of time. Accidental approval. Due to fatigue, distraction, or confusion, the user taps “Approve” or “Yes” just to stop the notifications. Successful access. The attacker gains legitimate access, with logs showing a valid MFA-approved session. Why Push-Based MFA Is Vulnerable to MFA Fatigue? Push-based MFA is popular because of its convenience. A single tap is often all that’s required to complete authentication. However, this low friction also introduces risk. Push notifications often: Provide little context about the login attempt; Can be triggered repeatedly without meaningful limits; Rely entirely on user judgment at the moment of approval. This risk can be partially mitigated by using CWYS (Confirm What You See) feature, a feature introduced by Protectimus.With this feature the push notification displays contextual details about the action being approved, making accidental or automated approvals far less likely. Alternatively, the issue can be further reduced by moving away from push-based authentication altogether and adopting alternative authentication methods, which we will discuss later. Is MFA Fatigue an MFA Bypass or User Error? From a technical perspective, MFA fatigue is not a cryptographic failure. MFA works exactly as designed – the system sends a request, and the user approves it. However, from a security standpoint, MFA fatigue represents a practical MFA bypass. The attacker gains access without breaking MFA, simply by manipulating the approval process. Because the login is successfully approved, such attacks are difficult to detect using traditional security logs. The session appears legitimate, even though it was initiated under malicious pressure. The Human Factor Behind MFA Fatigue Attacks MFA fatigue attacks succeed because they exploit well-known cognitive patterns: Alert fatigue – repeated notifications reduce attentiveness. Habituation – users become accustomed to tapping “Approve”. Context switching – requests arrive during meetings or off-hours. Desire to stop interruptions – approval becomes a shortcut. Even security-aware users can make mistakes under sustained pressure. This highlights that MFA fatigue is not a...