Lesson 5.10: MFA fatigue and account takeover
MFA stops most password attacks, so attackers attack the MFA step itself: flooding a user with push prompts until one is approved (MFA fatigue), calling to 'help', swapping SIM cards to receive codes, or phishing the code in real time. Once in, they register their own device and set up mailbox rules so they stay in. In the lab you investigate Maya's account in the identity provider's sign-in log with jq: the stolen password, 37 denied prompts at 3 a.m., the one approval, and everything the attacker did next, then harden the push policy.
17 min
You will learn to
- Explain MFA fatigue, SIM swapping and real-time phishing
- Query JSON logs with jq
- Recognise persistence after account takeover
- Configure number matching and prompt limits
- Rank MFA methods by phishing resistance
Key terms
- MFA fatigue (push bombing)
- Sending push prompts over and over until the user approves one.
- SIM swapping
- Convincing a mobile operator to move a victim's number to the attacker's SIM, to receive their SMS codes and calls.
- Adversary-in-the-middle (AiTM)
- A phishing proxy that passes the real login through and steals the session cookie after MFA.
- Number matching
- The app asks for a number shown on the login screen instead of a simple Approve button.
- Phishing-resistant MFA
- Methods bound to the real website so they can't be relayed: FIDO2 security keys and passkeys.
← Hard and symbolic links · All lessons · HTTP and HTTPS: how the web talks, and how it's protected →