Accessibility links

Facebook   X   LinkedIn   Email

Beware of Push Bombing —The MFA Scam Designed to Wear You Down

By: Jim Stickley and Tina Davis
March 23, 2026

Cybercriminals are getting smarter about bypassing multi-factor authentication (MFA), and one of their favorite tricks is something called push bombing. It’s a simple tactic, but extremely effective when victims are caught off guard or overwhelmed. And most of us have probably been overwhelmed by notifications at some point, so this type of attack has proven successful time and again for attackers.

Push bombing (also referred to as MFA fatigue) happens when criminals get hold of your username and password—often through phishing, data breaches, or reused passwords. Then, because you have MFA enabled on your accounts (as you should), they try to get you to approve a login. Once they have your login credentials, they repeatedly trigger MFA push notifications to your phone or device. These alerts usually ask you to approve a login attempt. The attacker’s goal is to bombard you with so many notifications that you eventually tap “Approve” just to make them stop. And that one approval is all they need.

The FBI’s IC3 unit warned about this tactic used in the Scattered Spider attacks.

During an attack, you might see a rapid stream of authentication requests—sometimes dozens, even hundreds. Scammers hope it’s late at night or during a busy moment when you’re more likely to slip up and accept one. Some even escalate by sending a message pretending to be IT support, urging you to verify the login to “fix an issue.”

If someone falls for a push bombing attack, the consequences can be serious. That single approved notification grants the attacker full access to the account—whether it’s email, banking, work systems, cloud storage, or anything else tied to MFA. From there, they can steal data, lock you out, or use your account to target others.

The best protection is never approving unexpected login requests and switching to more secure MFA options like passkeys or authenticator apps. Staying alert can stop push bombers from pushing you.



Quack Attack: Aflac Breach Leaves Millions Exposed in Targeted Cyberattack

Identity Theft

Quack Attack: Aflac Breach Leaves Millions Exposed in Targeted Cyberattack

You’re not quackers, really. However, if you use that supplemental “duck” insurance, there’s information you should know. On June 12, 2025, Aflac detected unauthorized access to its U.S. network. The company quickly initiated its incident response protocols and halted the intrusion within hours. While operations remained fully functional and no ransomware was deployed, cybercriminals managed to access sensitive files. Aflac is still reviewing impacted files and hasn’t disclosed the exact number of affected individuals. READ FULL STORY
Yep. You Read That Right—16 Billion Records Exposed

Identity Theft

Yep. You Read That Right—16 Billion Records Exposed

On June 18, 2025, cybersecurity outlet Cybernews revealed a colossal compilation of 16 billion login credentials leaked online, making it one of the largest data exposures in history. This massive treasure trove, distributed across 30 separate datasets, includes usernames, passwords, session tokens, and metadata such as URLs—likely harvested via infostealer malware from infected machines. The leak isn’t tied to a single platform breach, but spans a wide array of services. It's likely you use one or more of them. READ FULL STORY
Scattered Spider’s Web Of Lies, Deception And Ransomware

Your Security

Scattered Spider’s Web Of Lies, Deception And Ransomware

Warnings from the FBI and CISA came in loud and clear recently…Scattered Spider’s cyberattacks are more hazardous and crippling than ever before. Their high-profile, financially motivated attacks rely on social engineering for data theft, extortion, and ransomware attacks. And when both security agencies release a joint advisory warning to us about this threat group, it’s smart to listen. These threat actors made headlines for crippling financial attacks against several large organizations recently and they've increased the stakes playing their games. READ FULL STORY
Revealed: We Are Still Terrible At Creating Passwords

Your Security

Revealed: We Are Still Terrible At Creating Passwords

Ah, passwords. Those tiny digital keys that can either protect your online kingdom or leave the door wide open for cyber-villains. Unfortunately, 2024 showed us that people are still using shockingly bad passwords. Spoiler alert: "123456," "password," and the oh-so-creative "qwerty123" remain top offenders. In fact, “123456” takes the top spot year after year. Hackers are practically throwing a party when they see passwords like these! Seriously, folks? You can do better than that. READ FULL STORY
Why Business Social Media Accounts Need Strong Passwords, Too

Corporate Security

Why Business Social Media Accounts Need Strong Passwords, Too

Business leaders and those responsible for their corporate social media accounts can use this reminder about the importance of secure passwords – you’re only one weak password away from a breach. It’s a truth that’s too easily forgotten, especially when it has to do with securing a company’s social media websites. Whether a company’s oversight is internal or done by a third-party provider, breached social media sites start with a compromised password and can end with damage to a company’s brand and worse. READ FULL STORY




We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.