MFA (Multi-Factor Authentication) Fatigue Attacks – 2024
A Cyberattack to Counter Multi-Factor Authentication
Catalog of Scams – A SCARS Institute Insight
Author:
• SCARS Institute Encyclopedia of Scams Editorial Team – Society of Citizens Against Relationship Scams Inc.
Article Abstract
An MFA fatigue attack is a cyber tactic where attackers bombard a victim’s device or account with repeated multi-factor authentication (MFA) push notifications until the victim becomes overwhelmed or annoyed.
The goal is to exhaust the target, eventually leading them to accidentally approve one of the authentication requests, thereby giving the attacker access to their account.
MFA (Multi-Factor Authentication) Fatigue Attacks are Increasing and People are Becoming Victims
Introduction
Multi-factor authentication (MFA) is a security method that requires users to provide more than one form of verification to access an account or application. MFA is an important way to protect online accounts and the data they contain, and it’s becoming more common as cyber threats increase.
An MFA fatigue attack is a method used by cybercriminals to exploit the human element of multi-factor authentication (MFA) systems. In these attacks, an attacker who has already obtained a user’s login credentials bombards the user’s device with continuous MFA push notifications, attempting to wear them down to the point where the user mistakenly or out of frustration approves the authentication request, thereby granting the attacker access to their account.
These attacks exploit the human element of MFA security. Instead of bypassing MFA through technical means, the attacker uses persistence, hoping the user will inadvertently approve the request, thinking it’s legitimate or simply to stop the flood of notifications. This type of attack often accompanies other social engineering methods, such as impersonating IT support to convince the victim that the notifications are legitimate.
This attack method has been used by groups like Scattered Spider and has proven effective against high-profile targets when traditional security defenses are in place
How MFA Fatigue Attacks Work
Here are the MFA Fatigue Attack steps:
- Credential Compromise: The attacker initially gains access to the victim’s username and password, usually through phishing or other social engineering tactics.
- MFA Bombardment: With credentials in hand, the attacker tries to log into the victim’s account. This triggers the MFA system to send repeated push notifications or prompts to the user’s mobile device or email.
- Exhausting the User: The attacker continues to send these authentication requests at frequent intervals. Over time, the victim may become overwhelmed, annoyed, or confused by the barrage of prompts.
- Unintentional Approval: The aim is for the user to accidentally approve one of the prompts, either out of confusion, frustration, or a mistaken belief that it’s legitimate. Once approved, the attacker gains full access to the account.
Examples of MFA Fatigue Attacks
- Uber Hack (2022): A high-profile MFA fatigue attack occurred during the Uber hack in 2022. The attacker obtained an employee’s login credentials and initiated an MFA fatigue attack by repeatedly sending push notifications to the employee’s phone. Eventually, the employee approved one of the authentication requests, allowing the attacker to breach Uber’s internal systems. The hacker then gained access to sensitive company information and openly taunted Uber’s security team.
- Okta Hack (2022): Another example involved Scattered Spider (LUCR-3), which targeted the identity provider Okta. Attackers used MFA fatigue to target an employee of a subcontractor to Okta. After a series of push notifications, the employee inadvertently granted access, allowing attackers to infiltrate Okta’s systems and later other client companies through the breached identity platform.
How to Prevent MFA Fatigue Attacks
- Educating Users: One of the most effective ways to prevent MFA fatigue attacks is through user awareness. Employees and individuals need to be educated about the dangers of approving unexpected MFA requests. If they receive repeated MFA prompts they did not initiate, they should report the incident to their IT or security team immediately.
- Time-based Lockouts: Organizations can configure MFA systems to temporarily lock accounts after a certain number of failed or rejected MFA attempts. This reduces the likelihood of an attacker successfully exploiting MFA fatigue.
- Phishing-resistant MFA: Using stronger forms of authentication, such as hardware-based security keys (like FIDO2 or YubiKey), can make it harder for attackers to bypass MFA by reducing reliance on push notifications or SMS codes.
- Additional Authentication Layers: Adding extra layers of security, such as biometric authentication or requiring contextual information (like location or device) to approve logins, can make it harder for attackers to succeed.
MFA fatigue attacks demonstrate how social engineering can bypass even robust security measures by exploiting human error and frustration. As attackers continue to evolve their techniques, organizations must combine technical controls with user training to mitigate the risks.
Please Leave Us Your Comment
Also, tell us of any topics we might have missed.
Leave a Reply
Thank you for your comment. You may receive an email to follow up. We never share your data with marketers.
Recent Reader Comments
on Major General John R. Evans, U.S. Army – Impersonation Victim: “This man also goes by the name of Evans McCoy and I was a victim.” Dec 1, 17:50
on Airlords/Air Lords African Crime Group Organization – Violent Crime & Cybercrime Gang – 2024: “Peter, please visit www.ScamVictimsSupport.org to begin learning how to recover form this. We are here to help you.” Nov 28, 18:31
on Report Scammers: “On May 9 2024 ENIOLA AKINOLA scam my email and took my money that was supposed to go into my…” Nov 28, 04:23
on Airlords/Air Lords African Crime Group Organization – Violent Crime & Cybercrime Gang – 2024: “I too am currently a victim of a relationship scam” Nov 27, 16:15
on Another Stolen Identity Used To Scam Women: Daniel Anderson: “Anderson Nicolas??? It’s the same person or a scammer?and they are doctor or only military? Now on Yemen? Please I…” Nov 27, 10:03
on KNOW YOUR ENEMY: Mandy’s Diary – Do You Know This Girl?: “I have seen this person many times she goes by the name of Sarah Buckman. Claim she lives in Ghana…” Nov 23, 17:40
Important Information for New Scam Victims
- Please visit www.ScamVictimsSupport.org – a SCARS Website for New Scam Victims & Sextortion Victims
- Enroll in FREE SCARS Scam Survivor’s School now at www.SCARSeducation.org
- Please visit www.ScamPsychology.org – to more fully understand the psychological concepts involved in scams and scam victim recovery
If you are looking for local trauma counselors please visit counseling.AgainstScams.org or join SCARS for our counseling/therapy benefit: membership.AgainstScams.org
If you need to speak with someone now, you can dial 988 or find phone numbers for crisis hotlines all around the world here: www.opencounseling.com/suicide-hotlines
A Question of Trust
At the SCARS Institute, we invite you to do your own research on the topics we speak about and publish, Our team investigates the subject being discussed, especially when it comes to understanding the scam victims-survivors experience. You can do Google searches but in many cases, you will have to wade through scientific papers and studies. However, remember that biases and perspectives matter and influence the outcome. Regardless, we encourage you to explore these topics as thoroughly as you can for your own awareness.
SCARS Resources:
- Getting Started Right: ScamVictimsSupport.org
- Sextortion Scam Victims: Sextortion Victims Support – The Essentials (scamvictimssupport.org)
- For New Victims of Relationship Scams newvictim.AgainstScams.org
- Subscribe to SCARS Newsletter newsletter.againstscams.org
- Sign up for SCARS professional support & recovery groups, visit support.AgainstScams.org
- Join our Scam Survivors United Chat & Discussion Group facebook.com/groups/scam.survivors.united
- Find competent trauma counselors or therapists, visit counseling.AgainstScams.org
- Become a SCARS Member and get free counseling benefits, visit membership.AgainstScams.org
- Report each and every crime, learn how to at reporting.AgainstScams.org
- Learn more about Scams & Scammers at RomanceScamsNOW.com and ScamsNOW.com
- Scammer photos ScammerPhotos.com
- SCARS Videos youtube.AgainstScams.org
- Self-Help Books for Scam Victims are at shop.AgainstScams.org
- Worldwide Crisis Hotlines: https://blog.opencounseling.com/suicide-hotlines/
Other Cyber Resources
- Block Scam Domains: Quad9.net
- Global Cyber Alliance ACT Cybersecurity Tool Website: Actionable Cybersecurity Tools (ACT) (globalcyberalliance.org) https://act.globalcyberalliance.org/index.php/Actionable_Cybersecurity_Tools_(ACT)_-_Simplified_Cybersecurity_Protection
- Wizer Cybersecurity Training – Free Security Awareness Training, Phishing Simulation and Gamification (wizer-training.com)
-/ 30 /-
What do you think about this?
Please share your thoughts in a comment below!
To Learn More Also Look At Our Article Catalogs
Scam & Crime Types
More SCARS
- ScamsNOW Magazine – ScamsNOW.com
- ContraEstafas.org
- ScammerPhotos.com
- AnyScam.com – reporting
- AgainstScams.org – SCARS Corporate Website
- SCARS YouTube Video Channel
![Natasha Nice - Impersonation Victim - Stolen Photos Used By Scammers - [UPDATED 2024] - ont he SCARS Institute RomanceScamsNOW.com - the Encyclopedia of Scams™](https://romancescamsnow.com/wp-content/uploads/2021/01/Natasha-Nice-1.png)
![Natasha Nice - Impersonation Victim - Stolen Photos Used By Scammers - [UPDATED 2024] - ont he SCARS Institute RomanceScamsNOW.com - the Encyclopedia of Scams™](https://romancescamsnow.com/wp-content/uploads/2021/01/natasha-nice.png)
Sempre achei invasivo deixar a minha localização em qualquer sítio ‘web’, mas pelos vistos é útil.