With the implementation of MFA comes new tactics, techniques, and procedures (TTP) malicious actors will utilize to compromise accounts.
One of the most commonly seen TTP performed against MFA protected resources is the use of MFA fatigue or "prompt bombing" by malicious actors. MFA fatigue refers to the overload of prompts or notifications a victim would receive via MFA applications. This technique only works if the malicious actor(s) have already compromised the credentials of a targeted account from a previous compromise such via phishing, brute forcing, or password spraying.
Once a threat actor has a victim's credentials, they will begin requesting approval for sign-in via the victim's MFA application. The goal for the threat actor is to overwhelm the victim's phone with MFA push notifications, hoping the victim approves one of the requests to make the notifications stop. If a victim accepts a malicious MFA request, the threat actor now has access to all data protected by MFA. Furthermore, once a threat actor has gained access to an account, they can update the compromised accounts to send MFA verification messages to telephone numbers they have access to, bypassing the need to have the compromised user approve future MFA requests.
If you receive any MFA requests that were not initiated by you do not accept them. Additionally, if you believe you are the victim for a MFA Fatigue attack please contact the OIT Support Center to update your NetID password.