MFA Fatigue – Push Notification Spamming

MFA is one of the best ways to protect any of your online accounts as it acts as a second layer of protection along with passwords.

However, there’s a method hackers use, attempting to sign into your account even with MFA in place. 

Multi-factor authentication (MFA), also known as two-factor authentication (2FA) is an important method for protection on any online accounts you have, including Office 365. It acts as a second layer of security making it more difficult for cyber criminals to hack into.

If you’re not clued up about MFA or why you should have it enabled, we strongly advise that you read this article about the importance of 2FA.

What are MFA Fatigue Attacks?

Attackers have begun to look for ways to compromise accounts even when they have additional layers of security. One of these methods is known as MFA fatigue or push notification spamming.

MFA fatigue refers to the overload of prompts or notifications the victim would receive via MFA applications. Push notification spamming is the technique hackers are using to log into victims accounts. This method can be partially effective, not because of the technology in place, but because it targets human knowledge. If someone isn’t as educated about MFA, they are more likely to become a victim to these attacks so it’s important that you’re aware and familiar with this method, to make sure you don’t fall for it.

How does Push Notification Spamming work?

Once a hacker signs into the victim’s account via username/email and password, they start requesting an approval for sign in from the victims MFA app.

For most victims, they won’t be attempting a sign in themselves, so will decline the request. At this point, they might believe that there’s an error with the MFA application.

However, after the first decline, the hacker doesn’t stop trying, repeatedly spamming push notifications to the victim’s phone requesting sign in approval.

After an overwhelming amount of notifications, the victim might eventually approve, leading the hacker to successfully sign in and have access to personal information and data.

Push Notification Spamming Demonstration.

Here’s a quick video showing how Push notification spamming and MFA fatigue attacks work.

How to Avoid and Prevent MFA Spam Attacks

The most important thing when it comes to avoiding these MFA attacks is awareness and knowledge about cyber security. If you are aware that these types of attacks exist, you’re less likely to get caught out and become a victim.

Enable Passwordless Login

In Azure AD, you are able to setup passwordless login. This is another type of sign in verification however instead of approving sign in via a single button, you must match the correct number from one device on another. This means it’s very unlikely you’ll be able to verify the sign in unless you’re actually signing in yourself on another device.

With this method, as soon as one prompt has been sent, the hacker will not longer be able to send prompts through to the victims device.

Get in touch.

If you have any questions about 2FA or your business’ cyber security, get in touch with our team on 01158 244 824 or email using the button below.

Interested in what else our IT Support package includes?

There are many reasons that IT support with Reformed IT is a great choice for your business or organisation. If you choose Reformed IT for your IT support, you'll receive all these benefits including help from members of our experienced team when needed.

Unlimited IT Support

We provide fully inclusive, onsite and remote IT support. In addition to that, it won't cost you extra for an engineer to attend your site to resolve a technical issue.

Device Status Monitoring

When we take on your IT support, we deploy our monitoring agent onto all devices and servers. This alerts us to any issues which you may be unaware of.

Data Breach Monitoring

There are over 8 billion breached passwords and personal information available on the dark web. There's a possibility that some of this data relates to your employees. We'll monitor dark web activity and provide reports of breached passwords.

Cyber Essentials Certification

We ensure every one of our clients achieve their Cyber Essentials certification at no additional cost. We also help them towards Cyber Essentials Plus ensuring that everything is ready for assessment.

Office 365 Monitoring

We monitor your Microsoft 365 tenancy with our 24/7 security operations centre. If there is strange activity we'll find it immediately  and alert you or resolve the issue straight away. Keeping your business secure.

Anti-Virus Software

Everyone wants to avoid computer viruses. We include anti-virus software as part of our IT support package to keep your devices safe and to save time when it comes to viruses.

Email Security

Over 90% of cyber attacks start with a phishing email. It's crucial that your business has the best defence against cyber criminals and scams when regarding your mailbox.

Backups for Office 365

We will ensure that all of your emails and files are backed up, at no extra cost. We recognise the importance of backups and disaster recovery so we feel it shouldn't be an added extra.

Managed Email Signatures

With our included Exclaimer signatures for Office 365 service, you can get more out of your email signatures instead of a simple message with no images.

Cyber Security Training

To keep you even safer from hackers, we provide globally recognised and market leading Cyber security training by PhishingTackle. This online training portal will provide your teams with guidance and information to reduce the risk of hackers and scams.

Asset and Warranty Tracking & Reporting

We provide you with a list of your current assets in the business by using our powerful remote management tools. This creates a monthly asset report so you can keep track of your hardware life cycles.

Reformed IT Academy

We'll provide your business with the best IT training and learning sources. With the Reformed IT Academy, you’ll be able to watch and complete over 700 courses to help grow your knowledge and skills.

Password Manager

Password managers make storing and creating passwords much easier and safer. Keeper password manager also auto-fills passwords making the sign in proccess much quicker.

Cyber Threat Monitoring

With Huntress, you'll have an extra layer of security to help keep hackers out of your business. You'll be able to Monitor cyber attacks and malicious activity.

5.0 97 reviews

  • Avatar Nathan W. ★★★★★ 4 months ago
    Reformed IT have been beyond brilliant with helping us improve our current IT infrastructure and security. The services that they provide has taken enormous pressure off our internal … More IT team. They are always keen on sharing their knowledge and skills and always go above and beyond. I can’t recommend them highly enough.
  • Avatar Samuel H. ★★★★★ 12 months ago
    Reformed IT are absolutely fantastic. They consistently go above and beyond to help no matter what issue I present them with.
    It is refreshing to have a provider that not only knows
    … More their stuff but is responsive and look to build a relationship with their client to provide a 'total package' experience.
  • Avatar Kerrie M. ★★★★★ 10 months ago
    We have used Reformed IT at our Company since day one and I cant recommend them enough. Genuinely!
    The staff are great! So friendly, which really makes a difference. They also clearly
    … More explain things to you, especially when i dont understand their IT/computer language. They never patronise me and are always there to help.
    They always resolve matters in good time and keep our company secure and up to date security wise. They make my life easier as Office Manager. So thanks!
  • Avatar Emily S. ★★★★★ 10 months ago
    Reformed IT are beyond brilliant, anytime I have called in need of help since working for Walton & Allen, nothing is too much trouble, they have resolved any issue with ease.
    … More staff are always happy to help, friendly service every time. It can be stressful when your job is based mostly on a computer, and there is some kind of problem you are unsure how to resolve, but with Reformed IT just a phone call away, it is so re-assuring to know that anytime I hit a roadblock, you guys are there to save the day!
    Big thanks to you all, be lost without you guys!