MFA Prompt Bombing: Why Your Second Factor Isn't Saving You

This article explains MFA prompt bombing attacks where attackers trick users into approving unauthorized login attempts using compromised credentials.

• •Attackers use valid passwords from breaches and repeatedly trigger MFA prompts on push-based systems to force user approval
• •The 2022 Cisco breach demonstrates the effectiveness of this attack, where an attacker used vishing calls combined with prompt bombing to breach enterprise systems
• •Push-based MFA is vulnerable because users receive prompts with minimal context about where requests originate or what devices are being accessed
• •Organizations should implement phishing-resistant factors like FIDO2 security keys and hardware tokens instead of push notifications
• •Blocking compromised passwords through Active Directory scanning and using conditional access policies based on geography and device posture can prevent attacks