MFA (Multi-Factor Authentication) Fatigue Attacks – 2024

MFA (Multi-Factor Authentication) Fatigue Attacks are Increasing and People are Becoming Victims

Introduction

Multi-factor authentication (MFA) is a security method that requires users to provide more than one form of verification to access an account or application. MFA is an important way to protect online accounts and the data they contain, and it’s becoming more common as cyber threats increase.

An MFA fatigue attack is a method used by cybercriminals to exploit the human element of multi-factor authentication (MFA) systems. In these attacks, an attacker who has already obtained a user’s login credentials bombards the user’s device with continuous MFA push notifications, attempting to wear them down to the point where the user mistakenly or out of frustration approves the authentication request, thereby granting the attacker access to their account.

These attacks exploit the human element of MFA security. Instead of bypassing MFA through technical means, the attacker uses persistence, hoping the user will inadvertently approve the request, thinking it’s legitimate or simply to stop the flood of notifications. This type of attack often accompanies other social engineering methods, such as impersonating IT support to convince the victim that the notifications are legitimate.

This attack method has been used by groups like Scattered Spider and has proven effective against high-profile targets when traditional security defenses are in place​

How MFA Fatigue Attacks Work

Here are the MFA Fatigue Attack steps:

1. Credential Compromise: The attacker initially gains access to the victim’s username and password, usually through phishing or other social engineering tactics.
2. MFA Bombardment: With credentials in hand, the attacker tries to log into the victim’s account. This triggers the MFA system to send repeated push notifications or prompts to the user’s mobile device or email.
3. Exhausting the User: The attacker continues to send these authentication requests at frequent intervals. Over time, the victim may become overwhelmed, annoyed, or confused by the barrage of prompts.
4. Unintentional Approval: The aim is for the user to accidentally approve one of the prompts, either out of confusion, frustration, or a mistaken belief that it’s legitimate. Once approved, the attacker gains full access to the account.

Examples of MFA Fatigue Attacks

1. Uber Hack (2022): A high-profile MFA fatigue attack occurred during the Uber hack in 2022. The attacker obtained an employee’s login credentials and initiated an MFA fatigue attack by repeatedly sending push notifications to the employee’s phone. Eventually, the employee approved one of the authentication requests, allowing the attacker to breach Uber’s internal systems. The hacker then gained access to sensitive company information and openly taunted Uber’s security team.
2. Okta Hack (2022): Another example involved Scattered Spider (LUCR-3), which targeted the identity provider Okta. Attackers used MFA fatigue to target an employee of a subcontractor to Okta. After a series of push notifications, the employee inadvertently granted access, allowing attackers to infiltrate Okta’s systems and later other client companies through the breached identity platform.

How to Prevent MFA Fatigue Attacks

1. Educating Users: One of the most effective ways to prevent MFA fatigue attacks is through user awareness. Employees and individuals need to be educated about the dangers of approving unexpected MFA requests. If they receive repeated MFA prompts they did not initiate, they should report the incident to their IT or security team immediately.
2. Time-based Lockouts: Organizations can configure MFA systems to temporarily lock accounts after a certain number of failed or rejected MFA attempts. This reduces the likelihood of an attacker successfully exploiting MFA fatigue.
3. Phishing-resistant MFA: Using stronger forms of authentication, such as hardware-based security keys (like FIDO2 or YubiKey), can make it harder for attackers to bypass MFA by reducing reliance on push notifications or SMS codes.
4. Additional Authentication Layers: Adding extra layers of security, such as biometric authentication or requiring contextual information (like location or device) to approve logins, can make it harder for attackers to succeed.

MFA fatigue attacks demonstrate how social engineering can bypass even robust security measures by exploiting human error and frustration. As attackers continue to evolve their techniques, organizations must combine technical controls with user training to mitigate the risks.