{"success":true,"data":{"id":"fake-mfa-fatigue-push-bombing-phish","label":"MFA fatigue / push-bombing phish — attacker spams the victim with MFA approval prompts and emails them claiming the pending Microsoft/Okta/Duo push must be approved to stop the codes, taking over the account when the victim caves (Uber 2022, heavy M365/Okta campaigns 2024-26)","description":"Email asking the recipient to \"approve the pending push\" / \"accept the 2FA prompt\" on their Microsoft Authenticator, Duo, Okta Verify, or Google Authenticator app — paired with a parallel stream of MFA push notifications spammed by the attacker. The attacker already has the password; the email gives the victim a plausible reason to tap Approve and hand over the account. Used in the Uber 2022 compromise and scaled across Microsoft 365 / Okta / Duo campaigns throughout 2024-2026. Real identity providers never ask users to approve a prompt they didn't initiate — genuine alerts describe the sign-in (device, location) and do not pressure the user to \"clear the queue.\"","tier":"danger","category":"phishing","isThin":false}}