S.M.M.

Stop Manipulating Me · A Field Guide to Psychological Influence

ENTRY No. T14.18
CATEGORY Social Engineering
CLEARANCE Public / Essential
EDITION 01
Dossier · Manipulation Tactic

MFA Fatigue Attacks

Digital Vector · Push Bombing · Common & Rising
Red Flag
How It WorksSEC 01

MFA fatigue attacks presuppose a prior compromise: the attacker already holds the username and password — from phishing, a breach dump, or infostealer malware — and the only barrier left is a push-based second factor. Because a simple “Approve / Deny” push requires no code and no context, the attacker repeatedly initiates logins so the victim’s phone buzzes again and again.

The wager is behavioral, not technical: that the victim will eventually approve to make the noise stop, assume it is a glitch, tap reflexively out of habituation, or be socially engineered into approving by a simultaneous call (“Hi, this is IT — we’re pushing an update, please approve the prompt”). The technique exploits the weakest common MFA design — simple approval push — and does not work against methods that require information the attacker lacks: number matching, or phishing-resistant FIDO2/passkeys bound to the specific site and device.

The lesson is two-part: recognize the flood as an attack signal — an unrequested approval prompt means someone already has your password — and migrate away from the approval-only factor that makes the flood viable.

Warning SignsSEC 02
  • Prompts you did not trigger. One, a few, or a flood of "Did you just try to sign in?" approvals you never initiated.
  • Odd-hour clustering. A burst of prompts arriving at unusual times, or when you are not logging in anywhere.
  • A coincident "it's IT" contact. A call or text urging you to approve — the social-engineering tell.
  • The "just make it stop" urge. Aversive, repeated buzzing that pressures you to end it by the fastest route.
  • Low-and-slow single prompts. Spaced hours apart to masquerade as routine sync errors — still anomalous.
Frequently Paired WithSEC 03
  • Phishing · T14.2
    Supplies the stolen password
  • Urgency Credential Theft · T14.17
    The urgency script paired with the flood
  • Help-Desk Manipulation · T14.19
    The "it's IT, approve it" nudge
  • Habituation · T8.19
    Repeated prompts lose their salience
How the Attack UnfoldsSEC 04
  • Stage 01 · Prior Theft
    The attacker already holds a valid password from phishing, a breach dump, or malware — the flood cannot start without it.
  • Stage 02 · The Flood
    Repeated login attempts fire "Approve / Deny" pushes so the victim's phone buzzes over and over.
  • Stage 03 · The Tap
    The victim approves — to stop the noise, assuming a glitch, or nudged by a paired "this is IT" call — surrendering the last lock.
Counter-ProtocolSEC 05
Defense: An unrequested prompt is a breach signal, not a nuisance — deny and report.
  • Deny every prompt you did not initiate , then report it immediately — a single unrequested prompt is already an incident.
  • Assume your password is compromised. Change it promptly, and anywhere it was reused.
  • Never approve because someone asks. Legitimate IT does not phone you to approve a prompt.
  • Fix the design. Move from approval-only push to number matching, and better, phishing-resistant FIDO2/passkeys.
  • Add structural guards. Push-rate limiting, lockout on repeated denials, and SOC alerting on prompt floods.