An MFA fatigue attack, sometimes called push bombing or prompt bombing, turns a security feature into a nuisance and then waits for the nuisance to win. The attacker already has an employee’s password. They try to sign in again and again, and each attempt sends an approval request to the employee’s phone. Sooner or later, late at night or in the middle of a meeting, someone taps Approve just to make it stop.
This guide explains why the attack works, the signs to watch for, and the changes that stop it, from what you tell employees to how the sign-in itself is designed.
How the attack works
The attack has three steps. First, the attacker gets a valid password: from a phishing page, from a leak at another service where the same password was reused, or from malware on a personal computer. Second, they start sign-ins with that password, and each one triggers a push notification. Third, they make the prompts hard to ignore: many in a row, at awkward hours, sometimes followed by a message or a call pretending to be the IT helpdesk and asking the employee to approve “to fix the problem”.
Nothing in the second factor is broken. The attack works on the person, not the technology. Approving is easy, the request looks routine, and the cost of pressing the wrong button is not obvious in the moment.
Why simple push approvals are exposed
A simple push asks one question, “Is this you?”, with little context and a single tap to answer. It quietly trains people to approve, because almost every request they see is genuine. It also assumes that the password in front of it is still secret, which is exactly what the attacker has already broken.
The warning sign is a prompt the employee did not cause. An approval request should only ever follow an action the employee started a moment ago.
Signs an attack is under way
Unexpected requests. Several approval requests in a short time that the employee did not start.
Odd timing or details. Requests at unusual hours, or showing a device or location the employee does not recognise.
Pressure to approve. A message or call, soon after the requests, asking the employee to approve one.
Noise in the logs. For IT, repeated sign-in attempts for the same account that start and are never completed.
What to tell employees
Approve only a request you started a moment ago, on a device you are using. If a request appears out of nowhere, deny it. Then report it through one known channel, such as a named IT contact or your usual ticket queue, never a number or link given in the message itself. Make it clear that IT will never ask anyone to approve a request over the phone.
Make reporting easy and free of blame. An employee who reports a mistaken approval straight away gives IT the best chance to cut access before any damage is done. People who fear trouble for a mistake tend to stay quiet.
Design changes that stop it
Remove the password. Fatigue attacks start with a stolen password. If sign-in has no password, there is nothing to steal first, and the usual starting point is gone.
Ask for a fingerprint or face, not a tap. A live biometric check makes each approval a deliberate act rather than a reflex.
Tie access to a known device. When access is tied to the device each person enrolled, a password or code captured somewhere else is not enough to get in.
Ask less often. Every unnecessary prompt makes the next one easier to approve without thinking. Ask for a second approval only for sensitive apps, and let people skip repeats for a short, set time.
Keep a record. Every grant, removal and admin action should be on record, so IT can see what happened, in what order and by whom.
How CyberCyko Workforce approaches it
CyberCyko laptop and work-app sign-in does not ask the employee to type a password or copy a one-time code, so there is no password for an attacker to collect first. The employee approves their own sign-in with the fingerprint or face check on their enrolled phone, and the signing key stays on that device.
Access is granted per person and per app and tied to the device the person enrolled. Apps you mark as sensitive ask for a step-up approval, with a remember-this-device window so people are not asked every few minutes. Removing someone’s access stops future sign-in through CyberCyko within seconds, and every grant and removal goes into a tamper-evident admin log.
Read more about the design, including what we store and what we cannot see, on the security page, or see how the approval looks on a real laptop on the passwordless laptop sign-in page.
People and technology together
No design removes the need for clear guidance. Technology reduces the chances of a mistake, and a simple, blame-free reporting path helps people respond when something still looks wrong. Put both in place, and an attacker with a stolen password and a stream of prompts has far less to work with.
See how it works in CyberCyko Workforce
See passwordless laptop sign-in Related