The First Sign: The Annoying Buzzing
It starts subtly. An employee files a help desk ticket: "I keep getting push notifications to approve a login, but it's not me." Then another ticket arrives. And another. Soon, the security operations center (SOC) sees a pattern in the logs: dozens, then
hundreds, of failed but valid login attempts against a handful of accounts. Each attempt triggers a multi-factor authentication (MFA) prompt on the user's phone. The attacker isn't trying to break the password; they already have it, likely bought off the dark web or stolen via a phishing attack. They are now attacking the human on the other end of the phone, betting that confusion, annoyance, or a moment of distraction will lead to the one thing they need: a single, mistaken tap on "Approve."
The Attacker's Playbook: Weaponizing Fatigue
This tactic is known as MFA bombing, MFA fatigue, or push bombing. It's a social engineering attack that exploits human psychology rather than a software flaw. The attacker’s strategy is simple: overwhelm the target. They might space the prompts out over hours to fly under the radar or unleash a relentless flood to cause maximum frustration. In some documented cases, like the 2022 breach at Uber, the attacker even followed up with a text or WhatsApp message, posing as the IT department and telling the user to approve the request to make the noise stop. The goal is to create decision fatigue, where the user becomes so desensitized or agitated by the alerts that their vigilance drops. An accidental approval is all it takes for the attacker to gain a foothold.
Inside the Digital War Room: The Immediate Response
Once an MFA bombing attack is suspected, the response is a race against the clock. The SOC team's first job is to identify the targeted accounts and the source of the login attempts. They analyze login data, looking for a high volume of MFA requests from unusual locations or IP addresses. Communication is critical. The team immediately contacts the targeted users, instructing them explicitly not to approve any unexpected prompts. The next step is containment. The easiest move is to temporarily disable the compromised accounts to stop the attack cold. Security analysts will also check to see if the attacker, should they have already succeeded, has tried to enroll their own device for future MFA prompts or change recovery details. This is a crucial step to prevent the attacker from establishing a more permanent foothold.
Hardening the Gates: From Push to Number Matching
Stopping the immediate attack is only the first half of the battle. The incident forces a hard look at the organization's defenses. The simplest and most effective countermeasure against MFA bombing is to move away from simple push notifications. The industry is rapidly shifting toward "number matching" MFA. Instead of a simple "Approve/Deny" button, the login screen displays a two-digit number, and the user must type that same number into their authenticator app to prove they are the one initiating the login. This small step makes it nearly impossible to approve a request by accident. Major providers like Microsoft have already made number matching the default setting for their authenticator apps precisely to combat this attack vector.
The Aftermath: A Stronger, Smarter Defense
After the dust settles, a post-incident review focuses on long-term resilience. Beyond implementing number matching, this often includes enhanced user training to recognize social engineering tactics and a clear protocol for reporting suspicious MFA activity. Security teams may also implement stricter rules, such as limiting the number of MFA requests allowed within a certain period and using adaptive authentication, which might require additional verification for logins from risky locations. Ultimately, an MFA bombing incident serves as a stark reminder that cybersecurity isn't a one-and-done setup. It's a continuous process of adapting to how attackers think and operate, recognizing that the human element is often the most critical layer of defense to protect.
