Cybersecurity glossary
What is MFA Push Bombing?
Learn what MFA push bombing is, how attackers flood authenticator notifications, how it relates to MFA fatigue, and technical controls that stop push notification abuse.
Definition
MFA push bombing is an attack pattern that generates a high volume of push-based multi-factor authentication notifications against a target account—usually after obtaining the password—to overwhelm the user and increase the chance of an accidental or fatigued approval.
Why notification volume became a weapon
Push authenticators notify users of login attempts in real time. That channel can be abused: if the system will emit a push for every try, an attacker can MFA push bomb a victim’s device until attention collapses.
Security teams should treat sudden push storms as active account-compromise attempts.
Anatomy of a push bombing campaign
Validate a password
Stuffing or phishing yields a working first factor for the target.
Automate login attempts
Scripts repeatedly hit the login endpoint to spawn push challenges.
Flood the authenticator
The victim’s phone receives a rapid sequence of Approve requests.
Wait for a mistaken allow
Fatigue, accidental taps, or social engineering produce success.
Capture the session
Attacker continues with SSO cookies or tokens while the user is still confused.
Technical enablers vs brakes
| Enabler | Brake | Notes |
|---|---|---|
| Unlimited MFA challenges | Per-account and per-IP rate limits | Hard stop on storms |
| Approve/Deny only UX | Number matching / challenge codes | Raises user effort for attackers |
| Any network triggers push | Risk-based suppression | Block impossible travel early |
| Long-lived sessions | Short TTL + continuous auth | Limits value of one tap |
Signals for detection
Challenge velocity
Many MFA pushes in minutes for one user.
Fail-then-success
Long denial streak followed by a single approval.
New device + storm
Push bombing from unfamiliar ASN or country.
Concurrent sessions
Legitimate user online while attacker session appears.
Help-desk tickets
Users report ‘my phone will not stop buzzing’.
Password spray correlation
Same pattern across multiple accounts from one botnet.
Mitigation checklist
- Throttle MFA push generation aggressively; cooldown after N challenges.
- Require number matching or phishing-resistant authenticators.
- Suppress pushes when risk engine already would deny the login.
- Alert SOC on push storms and auto-lock or step-up to FIDO when detected.
- Educate users to report storms immediately and never approve unexpected pushes.
- Review and revoke unexpected MFA device registrations after incidents.
- Invalidate refresh tokens and SSO sessions after suspected bombing success.
- Prioritize migration of executives and admins off push-approve MFA.
The practical takeaway
MFA push bombing weaponizes notification volume to force a human error. It is loud, detectable, and highly effective against unprotected push MFA.
Rate-limit the channel, demand richer confirmation, and move privileged users to authenticators that cannot be bombed with Approve taps.
Related security terms
MFA Fatigue
Human outcome attackers seek after push bombing campaigns.
Multi-Factor Authentication (MFA)
MFA methods that include vulnerable push-approve UX.
Phishing-Resistant MFA
Authenticators that eliminate tap-to-approve bombing surface.
Risk-Based Authentication
Can suppress push challenges from high-risk login paths.
Account Enumeration
May help attackers identify accounts worth bombing.
Frequently asked questions
What is MFA push bombing in simple terms?
Attackers hammer your phone with login approval notifications—sometimes dozens or hundreds—hoping you will eventually tap Allow or get confused enough to accept.
How is push bombing different from MFA fatigue?
Push bombing describes the high-volume notification technique. MFA fatigue describes the psychological effect and resulting approval. They usually appear together.
What enables push bombing technically?
An IdP or app that triggers a push challenge on every password-successful login without rate limits, device binding, or risk checks.
Can push bombing happen without a password?
Typically the first factor is already compromised. Some flows might allow challenge generation more loosely, but password theft is the common prerequisite.
Will silencing notifications protect me?
Muting may reduce stress but does not stop the attacker’s login attempts. Report the incident and change credentials using a trusted channel.
What vendor features help?
Number matching, contextual location/app details, challenge throttling, blocking unknown countries, and migrating users to passkeys or security keys.
What should incident responders do?
Invalidate sessions, reset credentials, review MFA device enrollments, check for persistence, and move the user to phishing-resistant MFA.
References
Explore authoritative guidance and frameworks related to mfa push bombing.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.