What is MFA fatigue, or push bombing?

It is an attack in which someone who already has a user's password triggers sign-in after sign-in, so that the user's phone fills with approval requests, often at night, until the user taps approve to make it stop. Sometimes the attacker also calls or messages the user, pretending to be IT. It works against simple approve-or-deny push prompts. The defences are on the identity side: switch on number matching, so that the user must type a number shown on the login screen; show the location and application in the prompt; limit the number of prompts per minute; alert on repeated denied requests; and tell staff that an unexpected prompt means their password is known, so they should deny it and call IT. Better still, move key accounts to passkeys or hardware keys. A network sensor does not see these prompts. NetSenX shows what happens if an attacker gets in: unusual sessions, scanning or uploads from the user's device on monitored segments, on every plan.

This answer also appears, with more context, here: Zero trust, identity and segmentation

← All 45 questions on Zero trust, identity and segmentationAll topics