Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Security Teams Use MFA Fatigue to Strengthen Authentication
Transcript
- Lucas: If these conversations are useful for what you're building or running, we want to keep them accessible and ad-free. You can support that at buy me a coffee dot com slash fexingo. Luna: Yeah, it's a small way to keep the show independent. And it really helps. Lucas: Alright, let's get into it. There's a specific attack technique that's been making the rounds in enterprise security circles for the past couple of years, and it's a nasty twist on multi-factor authentication. It's called MFA fatigue, also known as push bombing. Luna: I've heard of it. Attackers spam a user with MFA push notifications until they finally accept one, just to make the noise stop. Lucas: Exactly. And it's not theoretical. In early 2025, a midsize financial services firm with about 3,000 employees saw a coordinated push bombing attempt targeting their remote access VPN. The attackers had already compromised a set of credentials from a credential-stuffing attack, and then they triggered over 50 push notifications per user within a 10-minute window. Luna: Fifty pushes in ten minutes? That's relentless. How many users actually approved? Lucas: Eight out of the twenty targeted users approved at least one push. That's a 40 percent success rate for the attackers. And once they were in, they moved laterally to a file server and started exfiltrating client data. It took the SOC about 45 minutes to detect the anomalous authentication volume, but by then the damage was done. The firm ended up paying a ransom to prevent the data from being leaked. Luna: So the attackers didn't need to break the MFA system itself. They just abused the human element. What's the actual defense against this? Lucas: There are a few layers. The most immediate fix is something called number matching. Instead of just sending a generic 'Approve or Deny' push, the MFA provider shows a number on the screen, and the user has to type that number into the authenticator app. So even if you hit approve, you still have to enter the correct number. That stops the simple fatigue attack cold because the attacker doesn't know what number to send. Luna: That makes sense. But doesn't it add friction for users? I can imagine people complaining about having to type in numbers every time. Lucas: It does add a second or two, but the trade-off is significant. The same financial firm implemented number matching across all their Azure AD applications after the incident. In the following quarter, they had another push bombing attempt against the same VPN, but this time zero users approved. The attack failed entirely because the prompts required number entry. They measured a 94 percent reduction in successful MFA fatigue compromises. Luna: That's a concrete number. But number matching isn't available everywhere. Not all MFA providers support it, right? Lucas: Correct. Microsoft Authenticator supports it, Duo has something similar with their Duo Push with verification code, and Okta has a version. But if you're using an older RSA SecurID or a legacy token, you're out of luck. That's where conditional access policies come in. You can set rules that require MFA only from trusted locations or trusted devices, and you can limit the frequency of MFA prompts. For example, if a user authenticates from the corporate network, you can skip MFA for that session. That reduces the attack surface. Luna: So the idea is to reduce the number of MFA prompts overall, and when you do prompt, make them harder to blindly approve. What about more advanced defenses? I've heard about FIDO2 security keys being phishing-resistant. Lucas: FIDO2 keys are the gold standard right now. They use public-key cryptography, and the key is tied to the specific website or service. So even if a user is tricked into visiting a fake login page, the key won't authenticate because the domain doesn't match. Microsoft, Google, and Apple all support FIDO2 now. The downside is cost and logistics: you have to buy and distribute hardware keys to every user, and you need a backup key in case someone loses theirs. But for high-risk users—executives, IT admins, finance teams—it's absolutely worth it. Luna: Hardware keys do feel like a step back in convenience though. I've seen people forget them or leave them plugged into a workstation. Are there software-based alternatives that are equally resistant to MFA fatigue? Lucas: Passkeys are the software equivalent. They're based on the same FIDO2 standard, but the private key is stored on the device—like in the iPhone's Secure Enclave or Android's Trusted Execution Environment. They sync across devices via iCloud Keychain or Google Password Manager, so they're more portable. The catch is that they're still relatively new, and not all enterprise apps support them yet. But adoption is accelerating. In 2024, major platforms like GitHub and PayPal started supporting passkeys for login. Luna: Let's zoom out a bit. MFA fatigue attacks are on the rise because attackers have found that breaking MFA via social engineering is easier than finding a technical vulnerability. Do you see a future where push-based MFA becomes obsolete? Lucas: I think traditional push notifications are going to become less common for high-security environments. The trend is toward phishing-resistant authentication: things like passkeys, biometrics, and hardware keys. But the installed base is huge. According to a survey from the FIDO Alliance in early 2026, only about 18 percent of enterprises have deployed phishing-resistant MFA across their entire organization. Most are still using SMS codes or push-based authenticators. So there's a long tail of vulnerability. Luna: That seems like a slow migration. Is there anything organizations can do today, beyond number matching, to mitigate MFA fatigue while they plan a move to FIDO2? Lucas: Absolutely. One practical step is to implement location-based conditional access. For instance, if a user is in the office on the corporate network, you can allow a longer session without MFA prompts. If they're connecting from a coffee shop in another country, require MFA every time. Another tactic is to use device compliance checks: only allow MFA from devices that are enrolled in MDM and have the latest patches. That reduces the chance that an attacker is using a compromised device. Luna: And what about training? Does user awareness actually help here? Lucas: It helps, but it's not a silver bullet. A well-designed MFA fatigue attack creates so many notifications that users become desensitized. In one study, researchers found that after the fifth push notification in a minute, the probability of a user approving jumped to over 60 percent. So training alone won't stop it. You need technical controls first, then training to reinforce the behavior. Luna: There's also the risk of attackers impersonating IT support. I've read about cases where the attacker calls the user, pretends to be from the help desk, and says 'We're testing the MFA system, please approve the next push.' That's a more targeted social engineering variant. Lucas: Exactly. That's called IT support impersonation combined with MFA fatigue. In 2025, a healthcare organization in the Midwest was hit with that exact tactic. The attacker called the CFO, claimed to be from the IT security team, and said they needed to verify the MFA setup. The CFO approved a push, and the attacker gained access to the financial system. The organization lost about $2 million in fraudulent wire transfers before they caught it. Luna: So in that case, number matching wouldn't have helped if the attacker was on the phone asking for the number. They could have just read it out. Lucas: Right, that's a limitation. Number matching only works if the attacker doesn't have a real-time communication channel with the user. In cases where the attacker calls, the defense has to be about verifying the caller's identity. That's why some organizations implement a callback policy: if IT needs you to approve something, they call you back on a known number, not the one that called you. Or they use a separate verification channel like a manager approval workflow. Luna: So it's really a layered problem. You need technical controls, policy, and awareness. No single silver bullet. Lucas: Exactly. And that's the theme across a lot of identity security right now. The attackers are getting more creative with social engineering, and the defenses have to adapt. I think we'll see more adoption of continuous authentication—where the system constantly checks the user's behavior, not just at login. But that's still a few years from widespread use. Luna: Continuous authentication sounds like a whole other episode. For now, if I'm a CISO or a security manager, what's the one action I should take this week to reduce MFA fatigue risk? Lucas: If you're using a push-based MFA provider that supports number matching, turn it on. It's usually a toggle in the admin console. For Microsoft Authenticator, it's in the Azure AD blade under 'Authentication methods'—set the mode to 'Number matching.' For Duo, enable 'Duo Push with verification code.' That single change can cut your MFA fatigue attack success rate by over 90 percent based on the data we've seen. It's a quick win with minimal user impact. Luna: Good advice. And after that, start planning for FIDO2 or passkeys for your most sensitive accounts. Lucas: Absolutely. The landscape is shifting, and the attackers are already adapting. The organizations that move to phishing-resistant authentication early are going to have a significant advantage. As we see more sophisticated attacks, the cost of inaction is only going to rise. Luna: Well, that's a practical place to land. Thanks for walking through the mechanics of MFA fatigue and the defenses. I think listeners have at least one concrete takeaway today. Lucas: Glad it was useful. We'll be back next time with another deep dive into the world of enterprise security.