Source: The Hacker News — https://thehackernews.com/2026/05/mfa-prompt-bombing-why-your-second.html
Multi-factor authentication still matters. Push-based MFA is the weak part.
The Hacker News piece describes a familiar identity attack: an adversary gets a valid password, starts a login, and repeatedly sends MFA approval prompts to the victim’s phone until the victim approves one. The attacker does not need to bypass the second factor cryptographically. They need the user to surrender it under pressure, confusion, or a convincing support call.
That distinction matters. Prompt bombing is not an argument against MFA. It is evidence that some MFA methods give too much power to a rushed human decision with too little context.
What prompt bombing actually exploits#
The attack chain is simple enough to be dangerous.
An attacker first needs valid credentials. Those may come from breached password dumps, reused passwords, phishing, infostealers, or another compromise path. The source item points to breached password material as a common starting point.
Then the attacker targets a login flow that uses push-based MFA. Typical examples include VPN access, Microsoft 365, Okta, Duo, or similar identity portals. The attacker enters the correct username and password. The system sends a prompt to the user’s device.
The victim sees an approve-or-deny request. If they deny it, the attacker can try again. And again.
That repetition is the attack. The prompt becomes noise. A user may assume the system is broken, a session expired, or some background app is misbehaving. If the attacker adds a phone call pretending to be IT support, the request can start to feel procedural rather than hostile.
The core weakness is not that the user is careless. It is that the authentication method gives the user a high-stakes decision with limited evidence. Many push prompts do not make the risk plain enough: where the login came from, what device initiated it, whether the user actually started the login, and why the request is happening now.
A second factor that asks “Approve?” without enough context is not the same as a phishing-resistant factor.
Cisco showed why this works against mature targets#
The Hacker News article cites Cisco’s 2022 breach as a useful case study.
According to Cisco’s prior disclosure, the attacker first compromised a Cisco employee’s personal Google account. That account was syncing browser-stored credentials, including the employee’s Cisco VPN password. With the VPN password in hand, the attacker began sending MFA push requests to the employee’s phone.
The initial prompts did not work. The attacker then escalated to voice phishing. Cisco said the actor posed as trusted support organizations and used multiple calls to convince the employee to accept a push notification.
Once the prompt was approved, the attacker gained VPN access as that employee. Cisco later said the actor enrolled additional MFA devices for persistence, escalated privileges, reached internal systems including Citrix servers and domain controllers, and exfiltrated about 2.8 GB of data before removal.
The lesson is not “Cisco had bad security.” That would be the wrong read. The useful lesson is harsher: prompt bombing can work even where security teams are mature, because the attack sits at the seam between valid credentials, normal login infrastructure, and a person being manipulated in real time.
From the system’s point of view, a successful push approval can look legitimate. The password is correct. The second factor was accepted. If the environment does not add stronger risk checks, device controls, or phishing-resistant MFA, the login may not trip the alarms people expect.
Why push MFA is weaker than it looks#
Push MFA became popular because it is easy. Users do not need to type codes. Security teams get better coverage than passwords alone. Adoption is simpler than hardware keys or certificate-heavy models.
That convenience is also the trade-off.
A push approval is often a binary decision under bad conditions. The user may be distracted. The prompt may arrive during a workday full of real authentication events. The interface may not clearly prove that the login is tied to the user’s current action. If prompts repeat, the user may approve simply to stop them.
Number matching improves this by forcing the user to enter or confirm a number displayed on the login screen. That makes blind approval harder. It does not make the entire identity system invulnerable, but it changes the attack from “tap approve” to “prove you are looking at the same login flow.”
FIDO2 security keys and other phishing-resistant methods go further. They bind authentication to the legitimate service origin and remove much of the user’s subjective judgment from the approval path. An attacker with a password cannot simply call the user and ask them to tap through a push prompt.
The practical ranking is clear enough:
- Password-only access is worse.
- Push MFA is better than password-only, but exposed to fatigue and social engineering.
- Number matching is stronger than basic push approval.
- FIDO2/WebAuthn-style phishing-resistant MFA is stronger still, especially for high-risk access.
The right answer is not one universal control for every login. It is matching the factor to the risk of the system being accessed.
What organizations should change#
The first fix is to stop treating all MFA as equivalent.
For VPN, privileged admin portals, cloud consoles, identity provider admin accounts, remote desktop, and other high-impact access points, push-only MFA is a poor default. Move those flows to number matching at minimum, and to phishing-resistant methods where feasible.
Second, reduce the number of valid passwords attackers can use in the first place. Prompt bombing usually starts after the password has already failed as a secret. Standard password complexity rules do not solve that problem. A password can satisfy length and complexity requirements while still being reused, leaked, or trivially modified from an old breached password.
Organizations should check corporate directories against known compromised password data and force resets when matches appear. This is especially important for Active Directory environments, where legacy password policy often gives a false sense of coverage.
Third, add risk signals before the prompt reaches the user. Conditional access rules can consider geography, device posture, impossible travel, unusual login time, unmanaged devices, and source network reputation. A suspicious login should be blocked or stepped up before the user becomes the main security control.
Fourth, train users on one narrow behavior: unexpected MFA prompts are security events. They should deny the request and report it. Training that says “be careful” is too vague. The message needs to be operational: if you did not initiate the login, do not approve it, even if someone calling as IT tells you to.
Finally, monitor for the pattern itself. Repeated MFA prompts, multiple denies followed by one approval, new MFA device enrollment after a suspicious login, and VPN access from unusual locations are not normal background noise. They are useful identity telemetry.
What not to overclaim#
Prompt bombing does not mean MFA is broken. It means some MFA deployments are too easy to socially engineer.
It also does not mean every push prompt is dangerous by default. Push-based MFA can still reduce risk for low-sensitivity access, especially compared with passwords alone. But for privileged access and remote entry points, the weakness is now well understood. Attackers do not need exotic malware when the login flow gives them a repeatable way to pressure the user.
The source article is also a contributed piece and includes vendor-oriented language. The technical point still stands, but readers should separate the useful control guidance from any implied product pitch. The defensible takeaway is broader than any single tool: retire push-only MFA where the blast radius is high, block compromised passwords early, and stop sending risky login decisions to users without context.
MFA was meant to make stolen passwords less useful. Prompt bombing restores part of their value. That is the gap to close.