thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

MFA Fatigue Attack

Repeatedly sending MFA push requests to a user with stolen credentials until they approve one.

Definition

Also called push bombing or prompt bombing, the attacker floods the victim's authenticator with approval prompts, often combined with a call pretending to be IT. Number matching, rate limiting and phishing-resistant MFA mitigate it. The 2022 Uber breach used this technique.

Example

A user receives 40 push notifications at 1 a.m. and approves one to make them stop.

Exam tip

Number matching in push MFA is the standard mitigation answer.

Related terms