Multi-factor authentication (MFA) is a security technique that requires users to provide multiple forms of authentication when accessing a system or service. This means that in addition to a username and password, users must provide an additional piece of information, such as a security code or biometric data, to verify their identity. MFA is an important security measure because it adds an extra layer of protection against unauthorized access.
In the past, authentication systems typically relied on just a single factor, such as a password, to verify a user’s identity. However, this approach is not always secure, as passwords can be easily guessed or stolen. MFA addresses this problem by requiring users to provide multiple forms of authentication, which makes it much harder for attackers to gain unauthorized access.
MFA is particularly important in the context of corporate security, where protecting access to sensitive data and systems is critical. By implementing MFA, organizations can significantly reduce the risk of unauthorized access, helping to protect against cyber-attacks and other security threats.
MFA apps
MFA has become a standard across many organizations and has evolved into various forms based on user and organization preferences. One popular form of MFA is the use of push notifications through a mobile authenticator app. These apps allow users to easily complete or deny login requests with a simple tap on their phone.
While this method is convenient, it is also considered to be one of the weaker forms of MFA due to its ability to easily grant access with a simple push of a button.
MFA Fatigue and MFA Bombing
MFA fatigue refers to the overload of prompts or notifications the victim would receive via MFA applications. Hackers prey on this fatigue by sending repeated MFA requests to a user in a technique known as MFA bombing. This technique only works if the threat actor already has the credentials of a targeted account from a previous compromise such as phishing, brute force, or password spraying.
What happens once they have the credentials:
Once the threat actor has a victim’s credentials, they begin requesting approval to sign-in from the victim’s MFA application. The goal for the attacker is to repeatedly spam push notifications to the target’s phone requesting sign-in approval in the hopes that the target might believe there’s an issue with the MFA application and eventually approve a request to make the notifications stop. Once this happens, the threat actor gets access to everything the MFA application protects.
How to respond to an MFA bombing attack
When a user begins receiving multiple unsolicited requests from an MFA application they must change their password to that account immediately. The attacker will no longer have access to the request trigger once the user resets the password, so the requests should cease.It is also a good idea to inform the IT department or help desk as they may be able to track down the origin of the attacks and block that location.
What has been done to protect against this:
To help prevent these attacks, geo-blocking policies can be put in place to restrict sign-in activities from foreign countries or other areas where a user would never travel. Frequent password rotations may also prevent attackers from gaining access to older compromised credentials.
It is important to remember that while the attacker is trying to get access, MFA is actually preventing that hacker from compromising the system or account unless a user accidentally approves it. The MFA application may be spamming a user but it’s still doing the job and stopping unauthorized access.
Can anything else be done?
If anyone in your organization is experiencing an MFA bombing tactic or received an unexpected prompt from their authenticator app, please report it to your IT department as soon as possible.
It is also worth considering a switch to number matching or token-based authentication methods that are less susceptible to successful attacks.
Have questions about your MFA or need help assessing an ongoing security challenge? Book a consultation with a GCS security expert today. Click here.
FAQ: MFA Bombing
What is MFA bombing?
MFA bombing — also called MFA fatigue — is an attack where a criminal who already has your password floods you with push notifications from your authenticator app until you approve one out of frustration or confusion. One tap on “Approve” gives them your account. It works because it targets human patience, not technology, which is why it succeeded against even large, well-defended companies.
How do attackers get the password in the first place?
Usually from phishing, credential-stuffing with passwords leaked in other breaches, or infostealer malware. MFA bombing is a second-stage attack — the notification flood only starts after your password is already compromised. That is worth remembering: a burst of unexpected MFA prompts is not an annoyance, it is confirmation that your password is in someone else’s hands and needs changing now.
What should I do if I get MFA requests I didn't trigger?
Deny every request, change your password immediately, and report it to your IT team or provider — those three steps, in that order. Do not approve one just to make the notifications stop; that is exactly what the attacker is counting on. Whoever manages your Microsoft environment should then review the Entra sign-in logs to see where the attempts originated and block that access path.
How can a business prevent MFA bombing?
Move from simple push approvals to number matching, where the user must type a code displayed on the sign-in screen — Microsoft Authenticator supports this and Microsoft now enforces it by default. Conditional Access policies in Microsoft Entra can block sign-ins from unexpected countries and unmanaged devices before a prompt is ever sent. GCS configures both as standard for its Austin-area clients, because push-only MFA is no longer a defensible default.
Is MFA still worth using if it can be attacked?
Absolutely — MFA still blocks the overwhelming majority of account-takeover attempts, and MFA bombing only exists because MFA works well enough that attackers must trick users into defeating it. The answer is stronger MFA methods — number matching, or phishing-resistant options like Windows Hello and FIDO2 keys — not abandoning MFA.
Who can help set up phishing-resistant MFA for a small business?
Any provider that manages Microsoft 365 identities should be able to do this; the work happens in Microsoft Entra, not in a product you have to buy separately. For Austin businesses, GCS Technologies implements number matching, Conditional Access, and phishing-resistant MFA as part of its managed security service — typically using licensing the business already owns.