MFA Bombing: Understanding Fatigue and Push Flooding Attacks in Modern Cybersecurity

🔥 Real-World Incident: The Uber MFA Fatigue Attack

In September 2022, Uber suffered a high-profile breach that shook the cybersecurity world. Attackers gained internal access, not by exploiting unpatched vulnerabilities or advanced malware, but through a method called MFA bombing—also known as MFA fatigue or Push Flooding. The attacker spammed a contractor’s phone with push authentication requests until, out of annoyance or confusion, the user ultimately hit "Approve"—granting the hacker entry.

This attack bypassed one of security’s strongest shields: Multi-Factor Authentication. Let’s break down how it happened, why it worked, and how you can stop similar threats in your environment.

🔬 What is MFA Bombing (Fatigue)?

MFA bombing is a type of social engineering attack that overwhelms users with endless MFA approval prompts—often via push notifications, but sometimes through SMS or phone calls. The primary aim? User exhaustion and, ultimately, accidental or frustrated approval. Attackers hope victims will click "Approve" out of confusion or fatigue, unwittingly granting access to sensitive systems.

• 👆 Push Bombing: Flooding push notification requests to an authentication app.
• 📞 Voice or SMS Bombing: Spamming users with phone calls or SMS authentication requests.
• 😫 Fatigue Attacks: Wearing down the user’s vigilance to get a single, crucial approval.

🧠 Attack Flow: How MFA Bombing Works

Attackers must first obtain a user’s login credentials—typically through phishing, credential stuffing, or a previous breach. With valid credentials, the attacker initiates login attempts at an aggressive rate, triggering a wave of MFA prompts:

• 🎣 Credential Harvesting: Steal user credentials via phishing or dark web marketplaces.
• 📲 Flood Authentication: Exploit MFA push features to send constant approval notifications.
• 🌙 Target Off-Hours: Attack during late or early hours, making users less alert.
• 😩 Wear Down Victims: Continue until the user succumbs, mistakenly hitting "Approve."

In Uber’s case, attackers added a direct twist—they messaged the target via WhatsApp (posing as IT support) and instructed them to approve the MFA prompt for a "company system test." This blend of technical and social attack vectors increases the odds of success.

🪓 Root Cause: Human Factor Weakness

The technical root cause behind MFA bombing is simple: MFA systems that allow for unlimited push approvals—without further verification or behavioral analysis—are vulnerable to spam. Attackers exploit the human habit of clicking through notifications mindlessly, especially when bombarded at inconvenient times.

• 🔁 Unlimited Prompts: Systems lacking rate limits on MFA requests are most prone.
• 😰 User Fatigue: People make mistakes when pushed to frustration or confusion.
• 👾 Lack of User Awareness: Many users still don’t recognize that an MFA prompt should never be approved unless they initiated it.

💡 Technical Explanation: Why MFA Bombing Succeeds

MFA push works by sending a notification to a device. The assumption: if it’s you, you’ll recognize and approve. However, these systems often:

• ⚠️ Lack Context: Users see "Approve sign-in?" but get no source info, IP, or geography.
• 🛑 Don’t Limit Attempts: No threshold for failed or repeated requests from the same user.
• 📈 Ignore Behavioral Red Flags: No pause or alert if dozens of approvals are requested within minutes.

This design flaw gives adversaries the upper hand, especially when combined with spearphishing tactics. According to Microsoft, more than 20% of social engineering attacks in 2021 leveraged MFA bypass techniques—many using push fatigue.

📊 MFA Bombing: Security Stats & Industry Trends

• 🔢 30% of organizations now report at least one MFA fatigue attempt each quarter (source: Mandiant, 2023).
• 📈 50% of successful breaches involving MFA bypass used social engineering and push-bombing (Verizon DBIR, 2023).
• ⏰ Night-time Attacks: Most push bombing incidents occur at night, when vigilance is lowest (CrowdStrike Labs).
• 💼 Targeted Sectors: Attackers prefer tech, finance, and healthcare firms—high-value, with many privileged accounts.

Security experts now list "poor MFA implementation"—especially default-allow, push-only policies—as among today’s riskiest missteps.

🙅‍♂️ Real Attacker Techniques: Beyond Basic Bombing

• 📬 Spearphishing Follow-Ups: Attackers use WhatsApp, SMS, or email after push spamming, impersonating IT to "help" users approve logins (like Uber’s breach).
• 🛡️ Proxying/Spoofing: Adversaries use reverse proxies (EvilProxy, Modlishka) to capture tokens and fool two-factor systems.
• 🕵️‍♂️ SIM-Swapping: For SMS-based 2FA, attackers hijack the victim’s phone number to accept prompts themselves.
• 🧩 Chained Attacks: Combine MFA bombing with password spraying, credential stuffing, and phishing—raising user stress to maximize odds of success.

Attackers constantly evolve techniques, emphasizing the need for layered security—not just relying on MFA alone.

🛡️ Prevention Strategies to Defeat MFA Bombing

• ⛔ Limit Prompt Requests: Set policy to restrict MFA push attempts—lock account or require extra verification after 3-5 failed or ignored prompts.
• 🧠 User Training: Educate employees to treat EVERY unexpected MFA prompt as a potential attack. Train regularly on reporting suspicious activity.
• 🔍 Contextual MFA: Use authentication that displays info like IP, app used, or location. Geo warnings prompt users to deny requests not from their location.
• 🔴 Number Matching: Require users to enter a code displayed on their login screen, not just press "Approve." This foils mass push spamming.
• 🚫 Disable Push Where Possible: Prefer physical security keys (like Yubikeys) or app-based OTPs over push notifications alone.
• 🧐 Monitor Authentication Logs: Flag or alert on unusual numbers of MFA attempts or approvals, especially off-hours or from new locations/devices.
• 🔒 Zero Trust: Restrict lateral movement post-authentication through segmentation, privilege management, and continuous verification.

Combining these tactics drastically lowers your risk of succumbing to an MFA bombing incident.

📝 Codesecure MFA Bombing Checklist

• 🛡️ Review Your MFA Policies: Are you allowing unlimited pushes? If so, set limits and enable MFA challenge features like number matching.
• 👨‍🏫 Conduct Social Engineering Drills: Simulate push fatigue attacks and see how your users respond.
• 📊 Log Analysis: Audit logs for abnormal access patterns and repeated MFA requests.
• 📚 User Awareness Program: Refresh employees regularly on what to do with unexpected prompts.

🛠️ Codesecure: Protecting You From Modern MFA Threats

At Codesecure, our experts help organizations harden their authentication against the latest social engineering attacks, including MFA bombing and push flooding. We perform penetration testing, simulate real-world attack scenarios, and provide end-to-end MFA security reviews. Don’t let a simple misclick become your next breach headline.

• 📞 Contact us: +91 7358463582
• 📧 Email: osint@codesecure.in
• 🌐 Website: www.codesecure.in

Stay secure, stay vigilant!