Why MFA Fatigue Attacks Keep Succeeding Against Well-Defended Organizations
Push-notification MFA fatigue — spamming a user with approval requests until they tap 'approve' out of frustration — keeps working against organizations that have already deployed MFA correctly.
October 21, 2026
v1
2 min
Why MFA Fatigue Attacks Keep Succeeding Against Well-Defended Organizations
MFA fatigue (also called "push bombing") doesn't defeat MFA technically — it defeats the human on the other end of it. An attacker with a valid, phished password triggers repeated push notifications, often at inconvenient hours, until the target approves one just to make the notifications stop, or mistakes it for a legitimate login they forgot about.
What actually stops it
- Number-matching MFA (the user must enter a number shown on the login screen into the authenticator app) rather than a simple approve/deny push — this defeats fatigue attacks directly.
- Phishing-resistant authentication (FIDO2/WebAuthn hardware keys or platform authenticators) removes the pattern entirely, since there's no push notification to fatigue someone with.
- Rate-limiting and anomaly detection on repeated MFA challenges to the same user in a short window.
Related Articles
Encrypting a victim's files takes time and leaves forensic evidence. Increasingly, ransomware groups skip it entirely and go straight to exfiltration-and-extortion.
Two of the most consequential software supply-chain compromises on record share a root cause that most vendor-risk programs still don't test for.
A near-lapse in the CVE program's federal funding in 2025 was a real wake-up call about how much of global vulnerability management runs on a single point of failure.