Skip to content

Cybersecurity Atlasby Jer Catallo

Cybersecurity Atlas

One reference surface for application, cloud and product security.

API documentation

Find & Respond

AppSec Playbook
Vulnerabilities Atlas

Build & Harden

Hardening Atlas
Security Tooling

Learn the Fundamentals

Security Concepts

Resources

OWASP Top 10
MITRE ATT&CK
NIST Cybersecurity Framework

© 2026 Jer Catallo. Reference material only, always confirm against the official source.

About
API Documentation

MFA Fatigue Attack incident response playbook · Cybersecurity Atlas

Home
Playbook
MFA Fatigue Attack

MFA Fatigue Attack

HighIdentity & AccessA07:2021 – Identification and Authentication Failures

An attacker with stolen credentials floods a user with MFA push prompts, or poses as IT support, until the user approves one and grants access.

Immediate Response

1Revoke the user's sessions and refresh tokens and reset the password.
2Remove any MFA methods registered during the suspicious window.
3Review what the attacker accessed after the approved sign-in.
4Block the source IP addresses and alert the user's manager and security team.

Short-term Remediation

1Enable number matching and additional context such as location in push prompts.
2Rate limit MFA prompts and auto-lock accounts after repeated denials.
3Require identity verification steps before help desk resets MFA.
4Alert on bursts of MFA denials in the SIEM.

Long-term Prevention

1Move to phishing-resistant MFA such as FIDO2 security keys or platform passkeys.
2Apply conditional access that requires compliant devices for sensitive apps.
3Train users to report, not approve, unexpected prompts.
4Detect and block credential stuffing that supplies valid passwords in the first place.

Attack vectors

Repeated push notifications sent with valid stolen passwords
Phone or chat messages impersonating help desk staff asking the user to approve
Prompt bombing at night or during busy periods to induce accidental approval
Help desk social engineering to register an attacker-controlled MFA device

Indicators of compromise

Many MFA push denials for one user in a short period
An approved MFA prompt from an unusual location right after multiple denials
New MFA device registrations shortly after a password reset
User reports of unexpected login prompts

Tooling

Microsoft Entra ID ProtectionOkta ThreatInsightSplunkElastic Security

References

www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf
cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html