MFA fatigue, push bombing, and interception

Why this scenario matters

The attack often follows password compromise. Repeated push notifications, calls, SMS, proxy phishing, or help-desk manipulation pressure the user and bypass weaker MFA methods.

Preferred controls include phishing-resistant FIDO2 or passkeys, number matching, session and device binding, prompt limits, risk-based policy, recovery-process protection, and anomalous-MFA detection.

The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.

Relevant ATT&CK tactics

• Collection
• Credential Access
• Initial Access
• Persistence
• Privilege Escalation
• Stealth

Relevant ATT&CK techniques

• T1621 Multi-Factor Authentication Request Generation
• T1111 Multi-Factor Authentication Interception
• T1557 Adversary-in-the-Middle
• T1078 Valid Accounts

Reference frameworks

• MITRE ATT&CK T1621 Multi-Factor Authentication Request Generation
• MITRE ATT&CK T1111 Multi-Factor Authentication Interception