MFA is essential — but the most common implementation (push notifications to a phone) has a known weakness. Attackers with stolen credentials send a flood of MFA push requests until a tired or confused user taps 'Approve' to make them stop. Uber, Microsoft, and Cisco have all been compromised this way.
In September 2022, Uber's network was compromised by a teenager who obtained an Uber contractor's username and password from the dark web. The attacker then used push-bombing: sending repeated MFA push notifications to the contractor's phone until — after an hour — the contractor approved one to stop the harassment. The attacker then used WhatsApp to message the contractor directly, claiming to be Uber IT support, and social engineered additional access from there.
In the same month, Cisco's network was compromised through an identical technique. In 2023, casino operator MGM Resorts suffered a breach that cost an estimated $100 million — also initiated through social engineering and MFA fatigue techniques.
How Push-Bombing Works
Standard Microsoft Authenticator MFA works like this: you enter your username and password, Microsoft sends a push notification to your phone saying "Are you trying to sign in?" and you tap Approve. If an attacker has your username and password, they can trigger this push notification. Then they trigger it again. And again. At 2am. At 3am. Throughout the next morning.
Many users, particularly if they're half-asleep or rushing to get into a meeting, will eventually tap Approve to stop the notifications — not realising (or not thinking clearly enough to realise) that they're approving a login they didn't initiate.
The Fix: Number Matching and Additional Context
Microsoft introduced "number matching" for Authenticator push notifications to defeat this attack. Instead of a simple Approve/Deny prompt, the sign-in process displays a two-digit number on the screen. The Authenticator app shows three numbers — only one of which matches. The user must select the matching number to approve the sign-in.
This defeats push-bombing because: an attacker sending push notifications remotely doesn't have access to the number shown on the user's screen during a legitimate sign-in. Even if the user gets a push notification and opens the Authenticator app, they can't approve a sign-in they didn't initiate — the numbers don't match.
Microsoft has enabled number matching by default for Authenticator push MFA since May 2023. If your Microsoft 365 tenant was configured before this date, it may still have number matching disabled. Optimyze audits and enforces number matching for all managed Microsoft 365 tenants.
The Gold Standard: Phishing-Resistant MFA
For the highest-risk accounts — global administrators, finance staff, executive team — consider phishing-resistant MFA such as FIDO2 security keys (YubiKey or similar hardware tokens). These are immune to push-bombing, phishing-captured credentials, and adversary-in-the-middle attacks because the authentication is cryptographically bound to the specific website being accessed.
MFA fatigue attacks don't break MFA — they bypass the human component of it. Number matching eliminates the bypass for push notifications. For the most sensitive accounts, hardware security keys provide a level of protection that no social engineering technique can defeat.
