A multi-factor authentication fatigue attack (or MFA fatigue attack) is a computer security attack against multi-factor authentication that makes use of social engineering.[1][2][3] When MFA applications are configured to send push notifications to end users, an attacker can send a flood of login attempts in the hope that a user will click on accept at least once.[1]

In September 2022 Uber security was breached by a member of Lapsus$ using a multi-factor fatigue attack.[4][5]

In 2022, Microsoft has deployed a mitigation against MFA fatigue attacks with their authenticator app.[6]

Further reading

  • Haworth, Jessica (2022-02-16). "MFA fatigue attacks: Users tricked into allowing device access due to overload of push notifications". The Daily Swig. PortSwigger. Retrieved 2023-01-26.

References


This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.