MFA Prompt Bombing: Why Your Second Factor Isn't Saving You

The source describes MFA prompt bombing, in which attackers use valid account credentials and repeatedly trigger push-based MFA prompts to induce the user to approve a login. The technique may be paired with a vishing call from someone posing as IT support. Once approved, the attacker can log in as the user, and the login may appear legitimate to security systems.