How To Stop MFA Fatigue Attacks

This report describes MFA fatigue (also called push bombing) attacks — where attackers with stolen credentials repeatedly trigger MFA push notifications to coerce users into approving access — outlines the attack stages and real-world examples (e.g., Uber, 23andMe), explains how credential theft enables these attacks, and lists practical mitigations including limiting push attempts, using web authenticators or TOTP, adding contextual checks, improving security awareness training, and deploying identity-aware monitoring and IAM controls.