Glossary: Application and Credential Attacks, and AI Risks

MFA fatigue

Also written: push bombing, Multi-Factor Authentication Request Generation, T1621

An attacker who already has the password sends prompt after prompt to the user's phone until the user taps "Approve" to make them stop, as Sam did after 23 prompts.