MFA fatigue and push bombing: when the approval prompt becomes the attack
Multi-factor authentication works best when the second factor asks for something deliberate. A push-approval prompt asks for much less: a single tap. MFA fatigue attacks — also called push bombing — exploit that gap. An attacker who already holds a valid password triggers sign-in attempts again and again, flooding the target's phone with approval requests until one is accepted, whether by reflex, by annoyance, or in the belief that approving will make the prompts stop.
How a push-bombing run works
The pattern is consistent across cases security teams have documented. The attacker starts with credentials stolen elsewhere — infostealer logs sold in bulk are a common origin — and confirms the password still works. Then they repeatedly attempt to sign in, generating push notifications on the victim's registered device. Each prompt looks identical to a legitimate one, and years of harmless daily prompts have trained many users to approve without much thought. Campaigns often add a second layer: a call or message from someone posing as IT support, instructing the target to accept the prompts so they stop. From the user's side this is disorienting by design. A push prompt presents itself as if the user had initiated the login, but nothing on the notification proves who did. In principle the prompt is a security control; in practice it is a message on your screen that anyone holding your password can generate, and regenerate, until fatigue does the rest. Treating such a prompt as untrusted input is exactly the mental shift these attacks defeat.Uber, September 2022: the textbook case
The most cited example remains the Uber breach of September 2022. As TechCrunch reported, Uber attributed the intrusion to a hacker affiliated with Lapsus$ and said the external contractor's corporate password may have been purchased on a dark web marketplace, reportedly from logs produced by RedLine infostealer malware. The password alone was not enough, because the account demanded a second factor. The attacker triggered push prompts for more than an hour, then contacted the contractor on WhatsApp posing as Uber IT and told him the notifications would stop once he accepted. The attacker later described the outcome to TechCrunch in one sentence:And well, he accepted and I added my device.With that approval the attacker enrolled his own device for MFA and reached Uber's internal network over its VPN. As BleepingComputer documented, access then spread quickly: a message announcing the breach appeared in Uber's Slack, and the attacker reached cloud consoles, the Windows domain and the company's HackerOne tickets, reportedly downloading private vulnerability reports before access was cut. On a network share, a PowerShell script exposed admin credentials for Uber's privileged access platform, unlocking further secrets. TechCrunch's reporting noted that number matching was reportedly not in place where it mattered.
Cisco: the same lever, pulled differently
Cisco's incident response team, Talos, documented a parallel case the same year. On May 24, 2022, Cisco became aware of a compromise that began with an employee's personal Google account, which had synced corporate credentials saved in Chrome. The attacker combined voice-phishing calls posing as a trusted support organization with repeated MFA push requests until one was accepted, granting VPN access. Talos assessed with moderate to high confidence that the actor was an initial access broker tied to UNC2447, Lapsus$ and Yanluowang ransomware operators, and described the activity as pre-ransomware: access first, monetization later. Two breaches, same door: the push prompt, approved under pressure.Number matching and the mitigation ladder
The mitigations are well understood. CISA's guidance states that "phishing-resistant MFA is the standard all industry leaders should strive for, but any MFA is better than no MFA," names FIDO/WebAuthn authentication as the only widely available phishing-resistant option, and where that is not feasible recommends "numbers matching MFA to block mobile push bombardment." Microsoft has since made number matching standard for its Authenticator push notifications: the sign-in screen displays a number, and approval requires entering that number into the app. A prompt arriving out of context has no number to enter, which is exactly why the technique defeats blind approval.- Treat every unexpected prompt as untrusted input: deny it, report it, and change the password it was testing.
- Prefer factors that demand deliberate action — authenticator-generated codes or hardware keys — over plain tap-to-approve push.
- Never let work or high-value credentials sync into a personal browser profile; Cisco's attacker entered through exactly that gap.
- Reserve hardware security keys for the accounts that matter most; they are what TechCrunch reported held at Cloudflare during a similar attack.