<img src="https://ws.zoominfo.com/pixel/6169bf9791429100154fc0a2" width="1" height="1" style="display: none;">
Curious about how StrongDM works? 🤔 Learn more here!
Close icon
Search bar icon

MFA Fatigue Attack: Meaning, Types, Examples, and More

MFA Fatigue Attack: Meaning, Types, Examples, and More

This article investigates MFA fatigue attacks. We'll explain how they work, why they're effective, and who they typically target. We'll also provide real-life examples to help your team detect and prevent these threats. You'll leave with a clear understanding of MFA fatigue attacks and tips on how to shore up your cloud security to defend against them. 

What is an MFA Fatigue Attack?

An MFA fatigue attack—also known as MFA bombing or spamming—is a cyber attack that uses social engineering tactics to manipulate users. Through MFA fatigue, attackers exploit situational and psychological factors to get user authentication and gain unauthorized access to a protected system.

An attack involves a user getting bombarded by repeated multi-factor authentication requests to access a secure system or account. As the prompts asking for additional information (such as biometric data or a verification code) begin to pile up, users can get annoyed, frustrated, or impatient. 

During an attack, some users can also get worried and overwhelmed by the sudden surge of activity. In some cases, a panicked user may instinctively provide authentication data to log in and 'check' to see if everything is okay with their account. Unsuspecting users may even think the system is experiencing a glitch and authenticate just to get it to stop. 

Repeated notifications will test users' patience and vigilance, making them agitated and prompting a few to act in frustration. This is called MFA fatigue. The attack is more psychological than technological, leading some users to unknowingly grant unauthorized access to protected data. 

💡Make it easy: Prevent users from succumbing to MFA fatigue and keep your network secure with StrongDM's Zero Trust Privileged Access Management (PAM).

Types of MFA Fatigue Attacks

Cybercriminals will use every psychological trick to access sensitive data, including tactics to wear down vigilant users. Let's first break down how all MFA fatigue attacks begin:

Step one: getting hold of valid credentials

The first step to any MFA fatigue attack is accessing login credentials for a protected system or account. These usually include usernames, passwords, and PINs. Without this information, no one can trigger a multi-factor authentication prompt, which is the primary weapon in the attack.

Some methods bad actors use to get your details include:

  • Hacking: Password cracking and brute force attacks break in and steal credentials from files and computers with weak security.
  • Malware: Malicious software such as viruses, keystroke loggers, trojans, and spyware can make private data vulnerable.
  • Phishing: Emails and messages from fraudulent accounts (pretending to be from a trusted source) can solicit sensitive information by faking authority and establishing trust.

Last year saw a 73% increase in data breaches, breaking a record set in 2021.

With your credentials, an MFA fatigue attack moves into its second phase, typically taking one of three forms:

The blitz: pestering you with endless notifications

This type of attack is the most common, and how the cyber tactic got its name. 

Depending on how you've set up your security, MFA requests can come in via email, SMS, or smartphone applications that will confirm your identity through security codes or biometric data.

Since authentication is a routine part of online security, being asked a second or third time might not immediately set off any red flags. If you ignore the first few, users will continue to be pinged with MFA requests, which gets annoying pretty quickly.

A string of requests will eventually frustrate anyone, especially those working remotely or from co-working spaces. In such cases, a user might accidentally grant access after being flooded with requests, or they could do it in a moment of exasperation to try and get the notifications to stop.

The emergency: fabricating an urgent threat 

Another MFA fatigue attack combines spamming and phishing tactics to invent a scenario where users have a limited time to prevent serious consequences. 

Users might receive three or four MFA requests followed by spam emails warning them of a data breach and the need for urgent action—usually logging in (after providing MFA) and changing passwords. 

These MFA fatigue attacks build tension by creating a narrative rather than trying to overwhelm and stress users by inundating them. This tactic exploits the psychological burden of responsibility, putting executives, IT administrators, security personnel, and employees with high privileges at higher risk of being targeted. 

The smooth swindle: posing as a trusted source

The above tactic also works when the impersonating party pretends to be an authority, such as a bank, government, or reputable company. They could also pose as an old friend, a friend of a friend, or a trusted source. 

Instead of sounding alarm bells, these types of MFA fatigue attacks lull users into a sense of security through a methodical and calculated combination of spam and MFA pings. Messages can come through SMS, Facebook, Instagram, or WhatsApp, and they usually target users who work in hierarchical structures. 

Nearly all cyber-attacks are possible because of human error.

Examples of MFA Fatigue Attacks

Here are three examples from the last several years where hackers launched successful, coordinated attacks against reputable companies. 

1. Cisco Systems

In May 2022, Yanluowang ransomware group breached Cisco's internal systems. The attack aimed to blackmail the company by threatening to leak stolen files online. Hackers used MFA fatigue and sophisticated voice phishing to gain access and steal non-sensitive data, which they later published on the dark web. 

In response, Cisco updated its security measures and shared technical details of the breach to help other security teams do the same.

2. Uber

In the fall of 2022, global ride-sharing giant Uber confirmed a cybersecurity breach. Quickly, speculation grew that it was at the hands of an 18-year-old who bragged about the hack to employees via Uber's internal Slack.

The attack methods included:

  • Phishing
  • Impersonating Uber IT support via WhatsApp
  • Sending repeated MFA login notifications

Reports of the hack showed it accessed Uber's critical systems, including security software, AWS console, Windows domain, VMware virtual machines, and Google Workspace admin dashboard. The purported hacker even shared screenshots claiming deep access to the company's internal systems and sensitive data.

3. Microsoft

In 2022, the hacker group Lapsus$ released a cache of stolen code from Microsoft, confirming their suspected hack of the tech conglomerate the previous year. Microsoft has acknowledged the breach, confirming that MFA fatigue tactics were part of the attack. 

Entry into the system allowed the group access to employee and high-privilege accounts. They also breached source code repositories, including the Azure DevOps server, where the company develops projects like Bing, Cortana, and Bing Maps.

A study by Microsoft showed that 1% of users will accept an approval request on the first try, instantly making a network vulnerable.

These attacks highlight vulnerabilities in MFA and the need for zero-trust security models. These breaches and other high-profile hacks emphasize the need for robust security measures.

Small companies should heed the warning by learning from these examples, which serve as reminders that size and resources can't always protect you.

How to Detect an MFA Fatigue Attack

Educating yourself and your staff will improve your chances of detecting an MFA fatigue attack. Here are some things to look for:

A user has multiple failed login attempts from different locations or IPs.

Failing to log in repeatedly is a little suspicious but not entirely uncommon. However, if you notice it happening from different geographic locations or IP addresses, it may indicate an attacker is using automated tools to generate login attempts.

The system has sent an unusually high number of MFA requests to one or multiple users.

If you notice a sudden spike in MFA requests, that's a major red flag warranting immediate investigation. If your monitoring systems notice a spike outside working hours, that could mean the MFA fatigue attack is ongoing. 

You've received numerous user reports of annoying and continuous MFA prompts.

Since these attacks target and exploit users, they're the first to sense something is off. Encourage employees to report any unexpected or persistent MFA prompts immediately. If you see a flood or sudden surge of reports inconsistent with the past, it's cause to investigate. 

You've flagged a series of irregular access patterns or user activity. 

If the logs recording user activity and access patterns show any irregularities—for instance, logins from unusual locations, devices, or at odd hours—monitoring systems can flag it for investigation. You can then implement behavioral analytics to identify if it's an MFA fatigue attack.

Deploying enhanced monitoring and alerting systems

Advanced security systems, like Zero Trust Access Management platforms, leverage the latest tools to detect anomalies in authentication patterns. They also provide comprehensive, round-the-clock network security to identify potential MFA fatigue attacks and initiate protective measures before a breach occurs.

💡Make it easy: Robust security protocols and system-wide monitoring are designed to detect breaches and grant access to sensitive data only to authorized users. Learn more.

Four Ways to Prevent MFA Fatigue Attacks

Use these four prevention methods to stop unauthorized system access, data breaches, and theft resulting from an MFA fatigue attack:

1. Tighten MFA parameters: This can include the window for responses and the number of allowed attempts. Single sign-on (SSO) and the principle of least privilege are other options. You can also limit the location of where users can access a system and include biometric requirements for login.

2. Increase user education: From the C-suite to the front lines, everyone should receive updated training on recognizing and responding to social engineering tactics like MFA fatigue attacks.

3. Strengthen password management: Zero trust architecture and security features like FIDO2 authentication will strengthen your passwords, a fragile first line of defense in network security.

Over 80% of data breaches begin with weak passwords that were easy to crack or obtain.

4. Give your systems an upgrade: Whether it's reducing vulnerabilities through updates and patches or integrating PAM solutions into your current network, security measures and systems must evolve to keep up with the changing landscape of cyber threats. 

Simplifying MFA Fatigue Attack Prevention with StrongDM

We can't overstate the importance of multi-factor authentication to privacy protection. However, when bad actors are finding ways to exploit security measures, IT teams have to find ways to stay vigilant and defend against attacks.

StrongDM's Zero Trust PAM solution simplifies security by combining authorization, authentication, networking, and monitoring into a single platform. With protocols specific to MFA fatigue attacks, you can secure your network, monitor access controls, and protect users from social engineering threats.

Sign up for a free trial to see how StrongDM can make MFA fatigue attacks a thing of the past.

MFA Fatigue Attack: Frequently Asked Questions

What is the goal of an MFA fatigue attack?

An MFA fatigue attack aims to bypass security and gain access to a user's network or data. Attackers do this by bombarding users with repeated multi-factor authentication requests. This can confuse, worry, or annoy users, eventually wearing them down and tricking them into unwittingly granting unauthorized access to protected information.

What is the best course of action to defend against MFA fatigue?

Defending against MFA fatigue requires vigilant monitoring of all the access protocols across a secure network. Switching to adaptive authentication methods, using hardware tokens, enforcing least privilege, and implementing SSO can help. Educate users about emerging security threats and deploy centralized PAM platforms to streamline management.

What types of attacks does multi-factor authentication prevent?

Multi-factor authentication prevents several types of attacks and cybersecurity breaches. These include phishing, password cracking, man-in-the-middle attacks, credential stuffing, and social engineering. However, MFA alone may not provide enough security as hackers continue to find creative and sophisticated ways to launch cyber attacks.

How do hackers beat MFA?

The best way for hackers to beat MFA is to trick the user into doing it. Social engineering tactics such as inducing MFA fatigue are common, but there are many others. By convincing users that an MFA request is valid, hackers can bypass the strictest measures, such as biometric data, to access sensitive material. 

About the Author

, Technical Evangelist, has had a long 30+ year career in systems engineering and architecture, but has spent the last 13+ years working on the Cloud, and specifically, Cloud Security. He's currently the Technical Evangelist at StrongDM, taking the message of Zero Trust Privileged Access Management (PAM) to the world. As a practitioner, he architected and created cloud automation, DevOps, and security and compliance solutions at Netflix and Adobe. He worked closely with customers at Evident.io, where he was telling the world about how cloud security should be done at conferences, meetups and customer sessions. Before coming to StrongDM, he lead an innovations and solutions team at Palo Alto Networks, working across many of the company's security products.

StrongDM logo
💙 this post?
Then get all that StrongDM goodness, right in your inbox.

You May Also Like

MFA: The Brave New World of Authentication (Infographic)
Get ready to secure everything and anything with MFA. Easily combine security checks such as device trust and geo-location. With StrongDM you can MFA all resources (e.g., multiple clouds, diverse databases, or critical applications, etc.) without changing your applications’ code or infrastructure.
Snowflake's Security Warning Is Why Enterprises Need MFA Across All Their Resources
Snowflake's Security Warning Is Why Enterprises Need MFA Across All Their Resources
Recently, cloud computing company Snowflake issued a warning to its customers: hackers are actively targeting accounts that lack Multi-Factor Authentication (MFA). This warning comes amidst a rapidly unfolding saga that includes the high-profile Ticketmaster breach.
7 Reasons for Enterprises to Adopt Multi-Factor Authentication (MFA)
7 Reasons for Enterprises to Adopt Multi-Factor Authentication (MFA)
The world we operate in today is far different than it was even a couple years ago. More employees work from remote locations (as of late 2023, more than 12% of U.S. workers are fully remote), and more companies engage the services of freelancers and other outside workers. Organizations must recognize that the traditional physical boundaries no longer apply. They now need to secure a vast array of devices used by employees spread across various locations.
The Importance of Multi-Factor Authentication (How It Works)
The Importance of Multi-Factor Authentication (How It Works)
Getting users' passwords isn’t really that hard anymore. In fact, bad actors employ advanced technology that allows them to snowshoe (test billions of password combinations per second), rendering 90% of user-generated passwords susceptible to attacks. MFA significantly enhances security by requiring a second piece of information to verify a user’s identity. The additional 20 seconds a user spends receiving a code via SMS provides a level of protection that a password alone cannot offer.
9 User Authentication Methods to Stay Secure
9 User Authentication Methods to Stay Secure in 2024
User authentication plays an essential role in securing networks and ensuring that only authorized users can access sensitive data. As our infrastructure transitions from traditional on-premises setups to cloud and hybrid environments, our authentication methods must continue evolving.