Push-Bombing: How To Prevent It

Push bombing is a social engineering attack where a hacker who already has your stolen password floods your phone with repeated MFA login prompts until you approve one out of exhaustion or confusion. It’s also called MFA fatigue, MFA bombing, or prompt bombing, and MITRE’s ATT&CK framework tracks it formally as technique T1621.

It doesn’t exploit a technical flaw in MFA. It exploits a predictable human reaction to dozens of identical notifications at 11pm: eventually, someone taps “Approve” just to make them stop. That single tap has taken down Uber, Cisco, and MGM Resorts.

What is MFA Push Bombing?

A push bombing attack targets the weakest link in multi-factor authentication: the person holding the phone. The attacker already has a valid username and password, usually stolen through phishing, malware, or a dark web credential dump. Multi-factor authentication should still stop them at that point.

Push bombing works around that barrier by overwhelming the victim with so many approval requests that a tired or distracted person eventually taps “yes.”

What is Multi-Factor Authentication?

Multi-factor authentication (MFA) requires two or more of the following before granting access:

How a Push Bombing attack actually works

The attack follows a predictable pattern, whether it hits a small business or a Fortune 500 company:

1. Credential theft. The attacker obtains a valid username and password, often through phishing or malware, sometimes bought on the dark web.

2. Repeated login attempts. The attacker logs in with the stolen credentials, which triggers an MFA push notification to the real user’s phone each time.

3. The flood. The attacker repeats this dozens of times, often late at night, generating a steady stream of identical prompts.

4. Social pressure, sometimes added. In several real breaches, the attacker also contacted the victim directly, posing as IT support, to push them toward approving the request.

5. The mistake. Worn down, confused, or assuming it’s a glitch, the victim eventually approves one prompt, and the attacker is instantly authenticated.

Real-World Push Bombing attacks

This isn’t a theoretical risk. Push bombing has driven some of the most damaging breaches of the past few years:

• Uber (2022): An attacker linked to the Lapsus$ group bought a contractor’s stolen VPN password, then sent a stream of MFA prompts for over an hour. The attacker followed up on WhatsApp, posing as Uber IT, until the contractor approved a request, handing over access to Uber’s internal systems, including Slack and Google Workspace.
• Cisco (2022): Attackers combined voice phishing with prompt bombing after stealing an employee’s VPN credentials, eventually gaining access to Cisco’s corporate network.
• MGM Resorts and Caesars (2023): The Scattered Spider group used social engineering and push bombing to compromise both casino operators. Caesars reportedly paid a $15 million ransom, while MGM opted to rebuild its systems, absorbing significant operational losses.
• Marks & Spencer (2025): Scattered Spider repeated the same playbook, tricking help desk staff and running an aggressive push bombing campaign that led to a DragonForce ransomware deployment, disrupting roughly 1,049 stores.

Microsoft has reported observing thousands of MFA fatigue attempts daily across its platforms, and the CISA and FBI have jointly flagged push bombing as a core tactic of active threat groups targeting telecom, finance, and retail companies.

6 Ways to Prevent Push Bombing

None of these require exotic tools, just the right defaults and a bit of employee awareness.

1. Move to number matching or Phishing-Resistant MFA

Number matching requires the user to enter a code shown on their login screen into the push notification, which defeats blind “Approve” tapping. Phishing-resistant methods, like FIDO2 security keys or biometrics, remove the vulnerable push prompt entirely. Microsoft made number matching the default in its Authenticator app in 2023 for exactly this reason.

2. Enforce rate limiting on push requests

Limit how many MFA prompts a user can receive in a short window, and automatically lock or flag an account after repeated denials, so a flood of requests raises an alarm instead of just annoying the user.

3. Train employees on the real threat

Make sure your team knows that a stream of unexpected MFA prompts is not a glitch, it’s an active attack. Employees should deny suspicious prompts and report them immediately, not assume IT is testing something.

4. Strengthen password policies

A push bombing attack can’t start without a stolen password. Require unique, complex passwords for every account, enforce regular password changes, and make sure employees never reuse credentials across systems.

5. Build a security incident response plan

Define who investigates a reported push bombing attempt, how quickly accounts get locked, and how the team communicates with affected employees. A plan that only exists on paper doesn’t help during an actual attack, so test it regularly.

6. Monitor and Update security controls

Watch authentication logs for unusual patterns, like a burst of denied prompts followed by one approval, and keep MFA configurations current as vendors roll out stronger defaults like number matching.

To combat this sophisticated tactic, organizations must implement robust security measures and strategies. By staying proactive and vigilant, businesses can mitigate the risks posed by these increasingly sophisticated cyber attacks. 

1. Enhance MFA through advanced detection techniques

As cyber threats continue to evolve, the need for more secure authentication methods becomes increasingly important. By implementing advanced detection techniques, organizations can enhance their Multi-Factor Authentication (MFA) systems.

These methods utilize complex algorithms to analyze user behavior patterns and physical characteristics, providing an additional layer of security beyond traditional methods like passwords or security questions.

2. Implement phishing-resistant MFA

Implementing phishing-resistant MFA is crucial in ensuring the security of sensitive information. Phishing-resistant MFA methods may include biometrics, physical security keys, or time-based one-time passwords.

These methods help to verify the identity of users and prevent unauthorized access to accounts, even if login credentials are compromised. 

3. Increase User Education

One way to enhance user experience and improve cybersecurity is to increase user education. By educating users on the importance of strong passwords, recognizing phishing emails, and staying up to date on security best practices, organizations can empower their users to be the first line of defense against cyber threats.

Providing regular training sessions, sending out security reminders, and leveraging interactive learning platforms can all contribute to increasing user education levels within an organization.

Ultimately, a more educated user base can lead to fewer security incidents and a stronger overall cybersecurity posture.

4. Strengthen Strong Password Policies

Organizations must enforce complex password requirements to protect sensitive data and prevent unauthorized access. One approach is to require a minimum length of eight characters with a mix of uppercase letters, lowercase letters, numbers, and special characters.

Additionally, implementing password expiration policies can further enhance security by requiring users to change their passwords regularly. It is also important to educate employees on the importance of creating unique passwords and avoiding common practices like reusing passwords across multiple accounts.

5. Establish a Security Incident Response Plan

It is crucial for organizations to establish a security incident response plan to effectively handle security breaches and cyber attacks. The first step is to conduct a thorough risk assessment to identify potential vulnerabilities and threats.

Once the risks are assessed, the next step is to define roles and responsibilities within the response team to ensure swift action in the event of an incident. Communication protocols should also be established to quickly alert stakeholders and coordinate a response.

Regular training and testing of the plan are essential to ensure all team members are prepared to respond effectively to security incidents.

6. Monitor and Update Security Controls Regularly 

Monitor your security controls regularly to ensure that they are functioning properly and protecting your network from potential threats. It is important to update these controls regularly to stay ahead of emerging threats and vulnerabilities.

By staying vigilant and keeping your security controls up to date, you can minimize the risk of a security breach and protect your sensitive data. 

Looking to Strengthen Your Cybersecurity?

CloudConsole helps businesses move beyond basic MFA to phishing-resistant authentication and real-time monitoring. Our managed cybersecurity solutions cover exactly this kind of identity protection, and our guide to 10 IT tips every business should follow covers the password and 2FA habits that make push bombing harder to pull off in the first place.

If your business does experience a breach, our guide on what to do after a data breach covers the response steps. Contact us today to schedule a consultation.

Frequently Asked Questions

What is push bombing in cybersecurity?

Push bombing is a social engineering attack where an attacker who already has a stolen password floods a victim’s phone with repeated MFA approval requests until the victim taps “Approve” out of exhaustion or confusion. MITRE ATT&CK tracks it as technique T1621.

How does an MFA fatigue attack work?

The attacker logs in repeatedly with stolen credentials, which triggers a push notification each time. After enough identical prompts, often late at night, the victim approves one just to make them stop, giving the attacker access.

What companies have been hit by push bombing attacks?

Uber, Cisco, MGM Resorts, Caesars Entertainment, and Marks & Spencer have all suffered breaches that involved push bombing as part of the attack chain, several tied to the Scattered Spider threat group.

How can I prevent push bombing at my company?

Switch to number matching or phishing-resistant MFA, rate-limit push requests, train employees to recognize and report a flood of prompts, enforce strong password policies, and monitor authentication logs for suspicious patterns.

Is phishing-resistant MFA better than regular MFA?

Yes. Standard push-based MFA can be defeated by fatigue attacks and phishing proxies, while phishing-resistant methods like FIDO2 security keys and passkeys remove the vulnerable approval step entirely, blocking the vast majority of identity-based attacks even when a password is already compromised.