Critical 2026 Detection — MFA Push Notification Bombing Preceding Successful Aut

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•1

Detects a burst of multiple MFA push authentication denial events for a single user within a 10-minute window, indicative of an MFA fatigue (push-bombing) attack. This behavior is often followed by an attempt to wait for the user to inadvertently approve the notification.