📢 MFA-fatigue defense

Push-bombing floods a victim with approval prompts, hoping annoyance wins. A number the victim never sees is what actually stops it — not a plea to "please don't tap approve."

Real number-matching push MFA (Microsoft/Duo): signing in on device A displays a server-generated number; the push lands on your registered authenticator, device B; approving requires typing the number FROM device A INTO device B. An attacker can trigger sign-ins all day — they control device A, so THEY see the number — but the push still lands on the victim's device B, and the victim, never having seen device A's screen, cannot supply it even if fatigue tempts them to blindly tap approve.

Below, the attacker panel plays device A (it initiates pushes and sees each number); the victim authenticator panel plays device B (it lists pending pushes and NEVER shows the number). Approving from the victim panel demands a number — copy one from the attacker panel to see a legitimate approve succeed, or tap Approve blind to watch it fail.

Learn → MFA fatigue — death by a thousand prompts Learn → MFA enrollment & factors Learn → ITDR — detecting the attack, not just blocking it

🎯 Attacker — device A

flood this

Fire push initiations at your own account. Each one is a real pending challenge on the victim panel — and each shows YOU (the initiator) its match number, right here.

Numbers device A has seen

Nothing yet — initiate a push above.

📱 Victim — device B

defend this

What your authenticator app would show — pending pushes ONLY, no number. Approve demands one anyway: type it from the attacker panel to prove you're looking at the same sign-in, or leave it blank/wrong to see the defense hold.

Three defenses, all real

Number matching — an approve only succeeds with the exact number shown on the initiator's own screen. Three wrong guesses auto-denies the challenge (a brute-force cap on the 2-digit space).
Throttling — keep hammering "Initiate a push" past the window's limit and it 429s outright — no new challenge is created, the flood is refused, not just logged.
Fatigue detection — a burst of initiations raises a real mfa_fatigue security alert for an instructor to triage. Check the SOC dashboard after flooding above.

X-ray

🩻 X-ray — what actually happened

Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.