Multi-factor authentication (MFA) was once considered a definitive solution to unauthorized account access. Adding another verification step, usually a push notification or one-time password, significantly reduced the likelihood of account compromise.
However, cybercriminals continuously adjust their methods to overcome security measures. One such technique is MFA fatigue, an attack that manipulates human behavior to bypass even properly configured multi-factor authentication systems.
What Is MFA Fatigue?
Consider a scenario in which an employee receives an unexpected authentication notification at 2 AM while sleeping. The first request goes unanswered. Five minutes later, another notification arrives, followed by several more.
As the requests accumulate, the employee wakes up to a growing number of MFA prompts. At this point, three possible responses emerge:
- Dismiss the notifications and attempt to return to sleep, expecting them to stop eventually.
- Contact the organization’s security team, provided someone is available at that hour.
- Select “Approve” simply to end the continuous interruptions.
For an exhausted employee, returning to sleep may become the immediate priority. Cybercriminals exploit precisely this reaction. By repeatedly generating authentication requests, they create a state of MFA fatigue. The objective is to exhaust the targeted individual until an unauthorized sign-in attempt is approved.
Why MFA Fatigue Attacks Are Effective
Conventional phishing attacks aim to deceive individuals into revealing their login credentials. MFA adds an additional verification requirement intended to prevent stolen passwords from being sufficient for account access.
MFA fatigue relies on a different mechanism. Rather than attempting to obtain another authentication factor directly, attackers use repeated interruptions and psychological pressure to persuade legitimate users to authorize access.
- Persistent notifications: Cybercriminals may initiate dozens or even hundreds of authentication requests. Each additional notification increases frustration and disruption.
- Strategic timing: Authentication attempts frequently occur outside regular working hours, particularly late at night or during weekends, when employees may be less attentive.
- Additional social engineering: When repeated notifications fail to produce approval, attackers may contact the target through phone calls or text messages while impersonating IT personnel. They might claim that approving the request is necessary to resolve a technical problem.
The entire attack can succeed with a single approval. Once the targeted individual accepts a malicious authentication request, the attacker may gain access to the associated account.
Real-World Cases Involving MFA Fatigue
MFA fatigue is an established attack technique rather than a hypothetical security concern. Over recent years, similar methods have played a role in incidents affecting several internationally recognized organizations.
Uber (September 2022)
- Threat actor: Lapsus$ cybercriminal group.
- Incident details: After obtaining the credentials of an external contractor, Lapsus$ initiated numerous MFA push requests. When the contractor initially resisted, the attackers sent a WhatsApp message impersonating Uber’s IT department and instructed the contractor to approve the authentication attempt.
- Consequences: The attackers obtained access to internal Uber resources, including Slack, cloud infrastructure, and administrative tools.
Cisco (May 2022)
- Incident details: The attackers used voice phishing alongside repeated MFA authentication requests. The campaign involved a personal Google account associated with an employee’s Cisco VPN access. Eventually, the employee approved a request, enabling unauthorized entry into the corporate network.
- Consequences: The compromise allowed the attackers to move laterally through Cisco’s internal environment.
Robinhood (2022 рік)
- Incident details: Credential stuffing attacks resulted in compromised user accounts. Attackers subsequently generated repeated MFA prompts targeting those accounts. Some individuals reportedly approved the requests out of frustration with the continuous notifications.
- Consequences: The incidents reportedly enabled unauthorized trading activity and attempts to withdraw funds.
Okta (January 2022)
- Threat actor: Lapsus$ cybercriminal group.
- Incident details: The attackers targeted a support engineer employed by a third-party service provider. Repeated authentication notifications reportedly pressured the engineer into approving an unauthorized access request.
- Consequences: The incident provided the attackers with an entry point into systems associated with Okta’s infrastructure.
Microsoft (March 2022)
- Incident details: During a broader cyberattack campaign, suspected MFA fatigue techniques reportedly contributed to the compromise of Microsoft account credentials.
- Consequences: The attackers accessed internal code repositories and obtained source code related to Bing, Cortana, and other Microsoft products.
Additional Corporate Targets
Other organizations, including Twitter and Samsung, have also been associated with reports of MFA fatigue activity. Similar campaigns have affected numerous Microsoft Office 365 environments. Some of these operations have been linked to advanced threat groups, including Midnight Blizzard, also known as APT29.
How to Prevent MFA Fatigue Attacks
Defending against MFA fatigue requires security measures that address both authentication weaknesses and the human responses exploited by attackers. Several complementary approaches can reduce the likelihood of successful compromise.
1. Adopt Phishing-Resistant Authentication Methods
Push-based MFA offers a convenient authentication experience. However, its reliance on user approval makes it particularly vulnerable to notification-based attacks. Stronger authentication mechanisms can help reduce this exposure:
- FIDO2 hardware security keys (YubiKeys, Titan Keys): These physical authentication devices require possession of the security key during the login process. Their phishing-resistant design helps prevent unauthorized authentication.
- Certificate-based authentication: Authentication certificates associated with specific devices can reduce dependence on frequent manual approval requests.
- Number matching (such as Microsoft Authenticator): This mechanism requires users to enter or select a number displayed during the login process. It makes it harder to approve authentication requests without verifying the associated sign-in attempt.
2. Introduce Adaptive Authentication Controls
- Location- and time-based access policies: Authentication attempts originating from unfamiliar geographic regions or occurring at unusual times can be blocked or subjected to additional verification.
- Authentication rate limiting: Restricting the frequency of MFA requests helps prevent attackers from overwhelming employees with repeated notifications.
3. Provide Training Focused on MFA Fatigue
Many cybersecurity awareness training programs primarily address email phishing. However, employees also need specific guidance on recognizing and responding to MFA fatigue attacks.
- Explain that repeated, unexpected authentication requests may indicate an attempted account compromise rather than a technical malfunction.
- Instruct employees to reject and report suspicious login approvals, particularly when requests arrive outside normal working hours.
- Encourage employees to treat unexplained authentication activity as a potential security incident. Reporting an unusual request is preferable to approving it without verification.
4. Establish an Accessible, Always-Available Security Reporting Channel
Employees should have a straightforward way to report suspicious authentication activity at any time. A dedicated Slack channel, security hotline, or similar reporting mechanism can help identify and interrupt an attack before unauthorized access occurs.
At the same time, security operations teams must account for the possibility of excessive alerts. Automated triage processes and structured incident workflows can help distinguish genuine security threats from routine notifications, reducing the operational burden associated with alert fatigue.
Final Thoughts
Multi-factor authentication continues to be among the most effective measures for protecting accounts against unauthorized access. Nevertheless, it cannot eliminate every authentication-related risk. MFA fatigue illustrates how attackers can weaken otherwise reliable security controls by exploiting predictable human reactions.
The appropriate response is not to discontinue MFA. Instead, organizations should strengthen their authentication strategies through phishing-resistant methods, adaptive access policies, and targeted employee training. Combining these measures helps address both the technical and psychological factors that make MFA fatigue attacks successful.
Arsen platform helps reinforce one of the most vulnerable elements of an organization’s cybersecurity defenses: its employees. Human error remains a major security challenge, particularly as social engineering techniques become more sophisticated with the advancement of AI.
