Fatiga de MFA (push bombing): cómo funciona, señales y qué hacer
Business fraud · médio
With a password obtained by phishing, a breach or an infostealer, the attacker tries to log in repeatedly. Each attempt sends the victim's phone an "Approve sign-in?" prompt. They fire dozens of prompts, often at night, until the victim approves out of fatigue or by mistake.
It often comes with social engineering: someone calls or messages posing as IT support and says "we're fixing an issue, please approve the prompt". Once in, the intruder registers their own device as a second factor and moves through the network.
Sinais / Signs
- Multiple sign-in prompts you did not initiate
- Approval requests at odd hours
- "Support" contacting you asking to approve the prompt
- A new MFA device registered on your account
Prevenção / Prevention
- Never approve a sign-in you did not start
- Companies: replace simple push with number matching or FIDO2 keys/passkeys
- Limit prompt volume and lock after repeated denials
- Make clear IT support never asks you to approve MFA by phone
- Monitor new factor registrations and logins from unusual locations
O que fazer / What to do
- Deny the prompts and alert IT or security immediately
- Change your password: the attacker already knows it
- Ask for a review of MFA devices and active sessions
- If you approved by mistake, report it at once; a fast response limits damage
FAQ
If I get many prompts, has my password leaked?
Very likely yes. Change it and tell your security team.
Is SMS MFA better against this?
No. SMS has other risks, such as SIM swaps. The safest options are passkeys and hardware keys.
FBI IC3 - Internet Crime Complaint Center · CERT.br · Verizon DBIR 2025 (via breached.company)