Push Bombing (MFA Fatigue)
An attack where someone with a stolen password floods a victim with MFA push notifications until they approve one out of annoyance or confusion, rather than because they intended to log in.
aka: MFA fatigue, push bombing
Push bombing works against real multi-factor authentication, not despite it — the password is already compromised, so the notification is the only remaining barrier, and the attacker just wears it down. Modern mitigations add number matching (the user must type a code shown on the login screen into the push prompt) so a blind tap can’t approve anything.