MFA Fatigue Attacks Are Still Working. Here's Why and What Stops Them
Push-bombing attacks against MFA remain effective years after they were first widely reported. The problem isn't awareness — it's the authentication method itself.
MFA fatigue — repeatedly sending push notifications until a frustrated or confused user approves one — remains one of the most reliable initial access techniques we see in red team engagements and real-world incidents alike, despite years of security awareness content warning users about it.
The uncomfortable truth is that this isn't primarily a training problem. Asking a user to make a correct security judgment call at 11pm after their fifth push notification of the night is asking them to outperform a fundamentally flawed authentication UX. The technology, not just the user, needs to change.
The most effective mitigation we implement for clients isn't more training — it's replacing push-approval MFA with number-matching or, better, phishing-resistant authentication like FIDO2 security keys or platform passkeys for any account with privileged access. Number matching alone (requiring the user to enter a code shown on the login screen into their authenticator app) eliminates the pure push-bombing vector, since a random approval no longer works without the matching code.
For organizations not ready for a full passkey rollout, we recommend immediate configuration changes available in most identity providers today: rate-limiting push notifications, requiring number matching, and alerting on unusual push volume patterns. These are configuration changes, not procurement projects, and can typically be implemented within a single change window — there's no reason for any organization to still be running unlimited, non-number-matched push MFA in 2026.
More in Threat Intelligence
Do not wait for an attacker to show you where your weaknesses are.
Talk to a Brangus IT security engineer about a tailored assessment for your environment — no obligation, no generic sales pitch.