MFA fatigue: push-bombing as a phishing bypass technique

MFA fatigue (also called push-bombing or MFA-prompt-bombing) is a phishing bypass technique that begins with the attacker already holding a valid username and password for the target. The attacker logs into the identity provider, which triggers a push notification to the victim's authenticator app asking Approve or Deny. The victim denies. The attacker logs in again. Another push. The victim denies again. The attacker logs in fifty more times across an hour, frequently in the middle of the night, until the victim either approves a prompt out of frustration, taps the wrong button on a phone they thought was locked, or assumes the prompts are a system glitch and approves to make them stop. The moment the victim taps Approve, the attacker is inside.

The technique exploits the structural weakness of simple push-style MFA, which presents the user with only two options (Approve or Deny) and provides no contextual information about who is requesting authentication or from where. The victim has no way to distinguish a legitimate prompt from an attacker-driven prompt. The defender response, well-established by mid-2023 and shipped as default in Microsoft Authenticator and most major MFA platforms by 2024, is number-matching: the prompt requires the victim to read a number from the device requesting authentication and enter it on the MFA prompt. The attacker, who is not co-located with the victim, cannot provide the correct number.[CISA MFA guidance 2023 + Microsoft Identity Threat Defense 2024]

On 15 September 2022, an attacker affiliated with the Lapsus$ group used credentials purchased on the underground market to begin logging in as an Uber contractor. The contractor was, by attacker timeline, asleep or otherwise away from their phone when the push notifications began. Over the next hour the attacker repeatedly triggered the MFA push prompt. The contractor eventually approved a prompt, plausibly because the prompts were disruptive and the contractor assumed they were a system error rather than an attack.

The attacker, now inside as the contractor, found a PowerShell script on an internal network share containing hardcoded administrative credentials for Thycotic, Uber's privileged-access management platform. From Thycotic the attacker obtained credentials for AWS, GCP, GSuite admin, OneLogin, the Uber bug-bounty platform on HackerOne, and the internal Slack. The attacker then posted a message to a company-wide Slack channel announcing the breach, defaced the HackerOne bug-bounty platform, and posted screenshots of internal AWS and GCP consoles to public Twitter. The disclosure was unusually fast: Uber confirmed the breach publicly within hours of the Slack post.

The Uber case is canonical for two reasons. First, it demonstrated that the entire compromise traced to a single MFA push approval by a tired contractor; no zero-day, no novel malware, no advanced persistent threat. Second, it demonstrated the speed of post-compromise pivot when the initial foothold lands on a workforce identity with broad access. The two-hour timeline from contractor approval to public-Twitter disclosure remains the industry reference for how quickly an MFA-fatigue compromise can cascade. The remediation cost to Uber was not publicly itemised but is reliably estimated at high seven figures including IR engagement, credential reset across the affected services, post-event identity-architecture rework, and customer-trust restoration.[Uber public statement Sep 2022 + Lapsus$ attribution per multiple incident-response vendors]

The identity-architecture rework line is unusually large for an MFA-fatigue event because the remediation is structural rather than tactical. Most organisations that experience a push-bomb compromise do not stop at credential-reset; they deprecate simple push-MFA across the workforce. The cost of that rework is a one-time spend that lands in the event-cost line.[IBM 2025 + identity-platform vendor remediation cost benchmarks 2023-2025]

Both Uber 2022 and Cisco August 2022 (another canonical MFA-fatigue case) involved compromise of contractor or outsourced-staff identities rather than direct-employee identities. The pattern is not coincidence. Contractor identities tend to have three structural disadvantages that make them attractive push-bomb targets: weaker MFA enforcement (because the contractor's home organisation rather than the customer organisation controls the MFA implementation), broader access scope (because contractors frequently support multiple internal systems and inherit broad role-based access for convenience), and less consistent training (because contractor onboarding is shorter and less awareness-focused than full-employee onboarding).

The implication for enterprise contractor management is that contractor identities should be treated as higher-risk than employee identities for MFA enforcement purposes, not lower-risk. The pragmatic policy is to require number-matching MFA or FIDO2 for any contractor with access to internal systems above a defined sensitivity tier, regardless of the contractor's home-organisation MFA posture. The compliance overhead is real but the alternative (Uber's outcome) is materially worse.[Uber Sep 2022 + Cisco Talos blog post Aug 2022]

• All phishing attack vectors
• AitM phishing cost
• Vishing cost (helpdesk-reset pivot)
• Spear phishing cost
• Phishing cost in financial services
• Phishing cost for enterprise
• Abnormal Security cost
• mdrcost.com
• databreachcost.com
• zerotrustcost.com