Staff approving login prompts they did not start.

What's happening.

MFA fatigue, also called push bombing, is when an attacker who already has a password keeps triggering login approval prompts, often late at night, until a tired or confused person taps Approve.

CISA describes campaigns that flooded staff with prompts until someone said yes. The NCSC rates number-matched app prompts as only partly resistant to phishing because of this kind of fatigue, and rates FIDO2 passkeys and security keys as resistant.

What it means for you.

Once an attacker is approved, they have the same access as the staff member: email, cloud files and anything else that account reaches. The login looks legitimate, so it is easy to miss.

How to fix it.

1. Turn on number matching in your authenticator app settings, so the person has to type a number shown on the login screen.
2. Move to passkeys or hardware security keys for email and admin accounts when you can. Both CISA and the NCSC treat these as the strongest choice.
3. Tell staff that a prompt they did not start means someone knows their password. They should deny it and report it, not ignore it.
4. Reset the password of anyone who gets unexpected prompts, and check for sign-ins you do not recognise.
5. Avoid SMS and phone-call codes for important accounts where you can.