How To Stop MFA Fatigue Attacks

This report explains MFA fatigue (also called prompt- or push-bombing), an access-oriented attack technique where an adversary with stolen credentials repeatedly sends MFA approval requests to a user until the user approves, enabling account takeover; it details attack stages, provides a real-world example, discusses the connection to credential theft and BEC, and lists defensive measures (rate-limiting prompts, alternative authenticators, contextual checks, training, and monitoring).