MFA fatigue
Repeatedly triggering push approval prompts against an account whose password the attacker already holds, until the owner approves one to make the phone stop. Often paired with a call claiming to be IT and asking them to accept.
Why it matters to you
This is a design consequence, not a user failure. A factor that can be satisfied by a single tap has no way to express "I did not start this", so blaming the person who tapped fixes nothing. Number matching, or a factor bound to the login itself, removes the option. The signature in the logs is a run of denials inside a few minutes followed by one approval, and the denials are the incident rather than its footnote.
Where we meet it
It is discussed as an add on rather than as an attack: something you do after buying credentials, often alongside a calling service that supplies the voice on the phone. The technique costs almost nothing next to the access it converts.
Connected terms
OTP bot
An automated calling service that impersonates a bank or provider to trick victims into reading out their one-time codes. MFA bypass, sold as a subscription.
Credential stuffing
Replaying credentials leaked from one service against every other service, at scale, on the assumption that people reuse passwords. The industrial use for every combolist and log ever sold.
Adversary-in-the-middle phishing
A phishing page that proxies the real login instead of imitating it. The victim authenticates against the genuine site through the attacker's server, completes multi-factor as normal, and the attacker keeps the resulting session cookie.
More from the playbook
Adversary-in-the-middle phishing
A phishing page that proxies the real login instead of imitating it. The victim authenticates against the genuine site through the attacker's server, completes multi-factor as normal, and the attacker keeps the resulting session cookie.
Business Email Compromise (BEC)
Fraud committed from inside a real mailbox: the attacker reads the thread, waits for an invoice and answers it with different bank details. No malware, no attachment, nothing for a scanner to find.
Callback phishing
An email that carries no link and no attachment, only a plausible invoice or subscription notice and a phone number to dispute it. The attack begins when the victim calls, and the person who answers walks them into installing remote access software.
Checker
A tool that tests stolen credentials against a target service in bulk and sorts the live ones from the dead. The industrialized step between a combolist and an account takeover.