It is 11:40 at night. Your phone lights up: Approve sign-in? Microsoft Authenticator. You are in bed. Your laptop is closed. You did not ask for this. You swipe it away. Forty seconds later, it is back. Then again. And again. By the sixth one you are thinking that maybe if you just tap Approve it will stop.
That thought is the entire attack.
What is actually happening
Every one of those prompts is a real sign-in attempt with your real username and your real password. Somebody has it, from a phishing page, a leaked database, or a password you reused somewhere that got breached. The password got them through the first door. Multi-factor authentication is the second door, and the only thing standing between them and your mailbox is your thumb.
So they knock. And knock. The technique is called MFA fatigue, or push bombing, and it needs nothing clever: just a stolen password, a script, and a victim who is tired, busy or annoyed enough to tap the wrong button once. That is how Uber’s internal network was walked into in 2022. The attacker sent the prompts for an hour, then messaged the employee on WhatsApp pretending to be IT and asked him to accept “just this one”. He did.
The rule: if you did not just type your password on a screen in front of you, the answer to “Approve sign-in?” is no. Every time. There is no situation where IT needs you to approve a prompt you did not start.
What to do in the next two minutes
- Tap Deny, or “No, it’s not me”. In Microsoft Authenticator that also lets you report the attempt as fraudulent, which flags the sign-in for your admins and can lock the attacker out. Use it.
- Change the password. Now. Not tomorrow. The prompts prove it is already in someone else’s hands. Pick something new and unrelated, and if you used that password anywhere else, change it there too.
- Tell IT. One denied prompt is a scan. Twenty in a row is a targeted attempt, and your security team would very much like to know before the attacker moves on to the next name on the list.
- Do not “approve one to make it stop”. It does not stop. It gets much, much worse, and it happens in your name.
Why the prompt now asks for a number
You may have noticed that Authenticator no longer offers a plain Approve button. It shows a two-digit number on the sign-in screen and asks you to type it into the app. That is number matching, and Microsoft switched it on for everyone in 2023 precisely because of this attack. If you cannot see the number, you cannot approve the sign-in, and a random tap at 11:40 at night approves nothing. It is one of the quietest, most effective security changes of the decade, and most people only noticed that it made the prompt slightly more annoying. That annoyance is the point.
For the people who run the tenant
If you administer Microsoft 365, the users are your last line of defence and they should not be your only one.
- Number matching and additional context. Number matching is enforced; make sure the app name and the sign-in location are shown too, so a prompt from “Outlook, Lagos” at midnight looks as wrong as it is.
- Turn on “Report suspicious activity” in Entra ID so a denied prompt becomes an alert, not a shrug, and sets the user’s risk level so Conditional Access can act on it.
- Conditional Access: block the obvious. Sign-ins from countries you do not operate in, legacy authentication that cannot do MFA at all, and high-risk users should never reach the prompt in the first place.
- Move the people who matter to phishing-resistant MFA. Passkeys, FIDO2 keys and Windows Hello for Business cannot be push-bombed, because there is nothing to push. Admins first, then finance, then everyone.
- Watch for the pattern. A burst of failed MFA challenges against one account is the attack in progress. Alert on it. It is far cheaper to reset one password at midnight than to work out what someone did with a mailbox for three weeks.
None of this is exotic. The whole defence against MFA fatigue fits on a sticky note: if you did not start it, deny it, then change your password. Put it on the fridge. Put it on your parents’ fridge.
Had one of these at 2 a.m.? Tell us how it went in the General forum. And if you look after a tenant and want a second opinion on your Conditional Access policies, the Help forum is the place.