What is MFA Fatigue Attack and How to Prevent It

MFA fatigue attacks exploit human error to bypass multi-factor authentication. Learn what these attacks are, how they work, and ways to prevent them.

2024-12-18

What is MFA Fatigue Attack and How to Prevent It

What is MFA Fatigue Attack and How to Prevent It

In 2024, cyberattacks exploiting multi-factor authentication (MFA) weaknesses increased by 40%, according to the Verizon Data Breach Investigations Report (DBIR). Additionally, a 2024 survey by the Identity Defined Security Alliance (IDSA) reported that 91% of organizations experienced identity-based attacks, underscoring these threats' growing frequency and impact.

MFA fatigue attacks prey on human psychology rather than technical loopholes. It has affected major corporations, including high-profile breaches of companies like Uber, where an attacker exploited this method to gain unauthorized access.

This attack exposes a critical vulnerability in MFA systems—the human factor. In this blog, we’ll cover what MFA fatigue attacks are, how they work, why they are so effective, and actionable strategies to protect your organization.

What is an MFA Fatigue Attack?

An MFA fatigue attack (also known as an MFA bombing attack) occurs when a threat actor repeatedly sends MFA push notifications to a user’s device, hoping to wear them down. The attacker relies on the user’s frustration or confusion to accept the authentication request inadvertently.

Instead of bypassing technical controls, this attack exploits human behavior—particularly the likelihood of approving an MFA request simply to stop the incessant notifications. This method highlights the importance of security awareness training and the need to bolster human defenses.

How MFA Fatigue Attacks Work

MFA fatigue attacks overwhelm users with constant MFA requests. Let's dive into how these attacks work and why they succeed.

Step	Description
1. Credential Compromise	The attacker acquires the victim’s username and password through phishing, malware, or leaked credentials.
2. Push Notification Bombing	Using the compromised credentials, the attacker initiates multiple MFA requests to the victim's device.
3. User Fatigue	The victim becomes overwhelmed by repeated prompts and eventually approves one of the requests out of frustration.
4. Unauthorized Access	Once approved, the attacker gains access to the account or system.

Table 1: How MFA Fatigue Attacks Work

These attacks are increasingly successful due to the high number of push notifications and the likelihood that a user will accidentally accept one, especially if they are distracted or unaware of the threat.

Why Are MFA Fatigue Attacks So Effective?

MFA fatigue attacks exploit weaknesses in human behavior and security practices. Recognizing these specific weaknesses helps in building stronger defenses. Here are some key factors that make these attacks so effective:

Human Error: Despite robust technical measures, human error remains a weak link. According to the 2024 Verizon DBIR, the human element was a component of 68% of breaches. This happens because users often act under pressure, distraction, or misunderstanding of the situation.
Social Engineering: These attacks rely on social engineering principles, manipulating users through fatigue, stress, or trust in fake communications. By pretending to be legitimate, attackers trick users into approving MFA prompts.
Lack of Security Awareness: Many employees are unfamiliar with MFA fatigue attacks and don’t understand why constant prompts occur. Without security awareness, they may approve requests just to stop the notifications.
Repeated Notifications: Attackers exploit the assumption that repeated MFA prompts are a system glitch or error. Frustrated users approve notifications to resolve the issue quickly, unaware of the danger.

Real-World Examples of MFA Fatigue Attacks

MFA bombing or prompt bombing attacks, have been employed in several notable cybersecurity breaches: Here are five significant incidents:

Date	Organization	Description
September 2022	Uber	The Lapsus$ hacking group gained access to Uber's internal systems by repeatedly sending MFA push notifications to an employee. The attacker also contacted the employee via WhatsApp, posing as IT support, and persuaded them to approve the MFA request, leading to a significant security breach.
May 2022	Cisco	Attackers employed social engineering tactics, including MFA fatigue and voice phishing, to compromise an employee's credentials. By persistently sending MFA push notifications, they eventually gained access to Cisco's corporate network, resulting in data theft.
March 2024	Apple Users	A campaign targeted Apple users with repeated password reset prompts, causing MFA fatigue. Victims received numerous prompts on their devices, and in some cases, attackers followed up with spoofed calls pretending to be Apple support, attempting to extract verification codes.
2022	Microsoft	Attackers used MFA fatigue techniques to breach Microsoft accounts by sending numerous MFA push notifications to users. This method exploited users' frustration or inattention, leading some to approve the unauthorized access requests.
2022	Okta	The Lapsus$ group targeted Okta by leveraging MFA fatigue attacks. They gained access to a third-party contractor's account by sending repeated MFA requests, eventually leading the user to approve one and compromising Okta's internal systems.

Table 2: Real-World Examples of MFA Fatigue Attacks

These real-world prompt bombing examples show that MFA fatigue attacks are growing, leading to data breaches, operational downtime, and financial losses.

How to Defend Against MFA Fatigue Attacks

Implementing the right strategies can reduce the risk of MFA fatigue attacks. Here are key defenses:

Implement Robust Security Awareness Training

Educating employees about MFA fatigue attacks is crucial. Incorporate training that covers:

How MFA works and the risks associated with push notifications.
Real-world scenarios to help employees recognize suspicious MFA requests.
Best practices for responding to repeated MFA prompts.

Explore comprehensive security awareness training to reduce human risk factors.

Use Number Matching and Biometric MFA

Instead of basic push notifications, use number matching or biometric MFA. Number matching requires users to enter a code displayed on their device, making it harder for attackers to exploit fatigue. Multi-factor authentication with biometrics adds an additional layer of security.

Monitor and Respond to MFA Bombing

Deploy systems that can detect repeated MFA requests and flag unusual activity. Email incident response tools can help quickly identify and mitigate potential attacks.

Implement Time-Based MFA Lockouts

Enforce policies that lock out accounts temporarily after multiple failed MFA attempts. This reduces the window of opportunity for attackers to overwhelm users with requests.

How Keepnet Helps Combat MFA Fatigue Attacks

Keepnet provides organisations with the tools and strategies needed to defend against MFA fatigue attacks. By combining proactive measures and employee-centric solutions, Keepnet helps organisations strengthen their multi-factor authentication (MFA) practices and reduce human error vulnerabilities.

Security Awareness Training

Keepnet's tailored security awareness training programs educate employees on recognising and responding to MFA fatigue attacks. Through outcome-driven metrics, such as Protection Level Agreements (PLAs) and measurable Security Behavior and Culture Programs, employees gain practical skills to identify repeated MFA prompts, securely handle suspicious login requests, and avoid unauthorized approvals.

Picture 1: Keepnet Security Awareness Training

MFA Phishing Simulation

Keepnet’s MFA phishing simulation tests how employees respond to real-world attack scenarios. This helps organizations identify vulnerabilities, improve user awareness, and create a security culture.

Picture 2: A Sample Keepnet MFA Phishing Campaign Scenario

Incident Response Automation

Keepnet’s Incident Response helps you quickly detect suspicious emails and mitigate cyber risks. Keepnet's Incident Response Automation empowers organizations to swiftly detect and mitigate cyber risks posed by suspicious emails.

By leveraging advanced AI-powered tools and integrating with popular email platforms like Office 365, Google Workspace, and Exchange, it significantly reduces the average response time from hours to minutes.

The platform automates threat analysis, quarantines malicious emails, and facilitates employee reporting through the Phishing Reporter add-in, fostering a proactive security culture.

Picture 3: Keepnet Incident Responder Dashboard

Threat Sharing Platform: Keepnet's Threat Sharing product enables organizations to collaborate and share threat intelligence about MFA fatigue attacks. By leveraging real-time insights, companies can identify emerging attack patterns, enhance detection, and proactively defend against evolving threats.

Keepnet Threat Sharing Platform — Picture 4: Keepnet Threat Sharing Platform

Watch the Youtube video below to learn more about Keepnet Human Risk Management:

Schedule your 30-minute demo now

You'll learn how to:

Deploy AI-driven MFA phishing simulations to help employees recognize and respond to MFA fatigue attacks effectively.

Run seamless MFA phishing tests with no delivery issues, ensuring accurate insights and actionable outcomes.

Generate detailed user behavior reports and assign risk scores to improve employee security awareness and resilience.

Frequently Asked Questions

FAQs About MFA Fatigue Attacks

1. What are the signs of an MFA fatigue attack?

Common signs include receiving repeated MFA push notifications on your device, especially when you haven’t initiated a login attempt. Other indicators include unusual activity alerts from your account provider or unsolicited contact from someone claiming to be IT support.

2. Can MFA fatigue attacks bypass biometric authentication?

No, MFA fatigue attacks specifically exploit push notification systems. Implementing biometric authentication, such as fingerprint or facial recognition, significantly reduces the risk of these attacks by adding an additional, non-replicable layer of security.

3. Is MFA fatigue attack prevention expensive?

Not necessarily. Simple measures such as implementing number matching, setting up time-based lockouts, and running regular security awareness training are cost-effective strategies that greatly enhance protection against MFA fatigue attacks.

4. How often should organizations conduct MFA phishing simulations?

Organizations should conduct MFA phishing simulations quarterly or biannually. Regular testing ensures that employees remain vigilant and updated on evolving attack tactics, while also identifying vulnerabilities.

5. Are MFA fatigue attacks targeted at specific industries?

While any organization using MFA push notifications can be targeted, industries with high-value data—such as finance, technology, and healthcare—are more frequently attacked. Enhanced training and security protocols are essential in these sectors.