How To Stop MFA Fatigue Attacks

This article explains MFA fatigue (also called prompt bombing or push bombing), a technique where an attacker with valid credentials repeatedly triggers MFA approval prompts to coerce or trick a user into approving one, enabling account takeover. It outlines the attack flow, a notable Uber incident, the relationship to credential theft, and provides seven practical mitigation recommendations including limiting notifications, using stronger authenticators, adding contextual checks, awareness training, and monitoring.