What is an MFA Fatigue Attack? 

A multi-factor authentication (MFA) fatigue attack, also known as MFA bombing or MFA spamming, is a social engineering cyberattack where the attacker repeatedly sends MFA requests to the victim’s email, phone, or other registered devices. This attack aims to coerce the victim into confirming their identity via notification, which would authenticate the attacker’s attempt to access the victim’s account or device. This is part of a series of articles about insider threats.

How MFA Fatigue Works 

MFA fatigue attacks are a form of social engineering. To execute an MFA fatigue attack, the attacker must first access the victim’s login credentials, typically through a phishing email, a credential stuffing attack, or purchasing them on the dark web. Once the attacker has obtained the victim’s login credentials, they can attempt to log in to the victim’s account or device. If the account has MFA enabled, the attacker will be prompted to provide the second-factor authentication code.

To trigger the MFA push notifications, the attacker enters the victim’s email or phone number as the registered device for MFA. The attacker then repeatedly sends MFA requests to the victim’s registered devices, typically with a frequency that is designed to overwhelm the victim’s ability to properly verify the requests.

The victim may receive multiple MFA requests in quick succession, with the attacker using various social engineering tactics to make the victim feel under pressure to approve the requests quickly. For example, the attacker may claim that there is suspicious activity on the account or that failure to approve the requests will lock the account.

If the victim falls for the attacker’s tactics and approves the MFA requests without properly verifying that they are legitimate, the attacker gains access to the victim’s account or device. This can allow the attacker to steal sensitive information, carry out fraudulent transactions, or install malware on the victim’s device.

6 Ways to Protect Against MFA Fatigue Attacks

Enable Additional Context – Enabling additional context is one way to protect against MFA fatigue attacks. Providing users with more information about the authentication request can help them to determine whether it is legitimate. Here are some ways to enable additional context for MFA.

Adopt Risk-Based Authentication – Adopt risk-based authentication for MFA such as risk scoring, adaptive authentication, & dynamic policy management.

Implement the FIDO2 Authentication – FIDO2 is an open authentication standard designed to provide strong authentication without passwords. FIDO2 authentication can be implemented using hardware security keys like USB or NFC. These keys store the user’s private key and use public-key cryptography to verify the user’s identity. 

Disable Push Notification as a Verification Method – MFA push notifications are designed to be easy to use, as users must click “Yes” or “Allow” to approve login attempts. However, this simplicity also makes it easier for attackers to overwhelm users with fraudulent MFA requests.

Improve Security Awareness Around MFA – Educating users on the risks of MFA fatigue attacks and providing guidance on verifying MFA requests can help reduce the likelihood of successful attacks. Here are some ways to improve security awareness around MFA.

Protecting Against MFA Fatigue Attacks with an Advanced SIEM Platform – Protecting against MFA fatigue attacks requires a proactive approach, which can be achieved by combining advanced SIEM (Security Information and Event Management) solutions with user and entity behavior analytics (UEBA) and other security best practices. Advanced SIEM platforms provide real-time monitoring, threat detection, and incident response capabilities to help organizations detect and mitigate MFA fatigue attacks.

Read More