MFA Fatigue Attacks: How Indian Enterprises Can Defend Against Authentication Bypass

• 17 September, 2026
• No Comments

Multi-factor authentication (MFA) was once considered the gold standard of identity security. Add a second factor — a one-time password, a push notification, a hardware token — and you dramatically reduce your exposure to credential-based attacks. Indian enterprises have invested heavily in MFA rollouts over the last several years, driven by CERT-In advisories, RBI guidelines for the BFSI sector, and growing awareness of phishing and account-compromise threats.

But threat actors adapt. A technique known as MFA fatigue — also called push bombing or MFA prompt bombing — has become one of the most reliable ways for attackers to compromise accounts protected by push-based authentication. High-profile breaches at major technology companies have demonstrated in uncomfortable detail just how effective this technique can be. Indian enterprises, many of which rely on Microsoft Authenticator, Duo, or similar push-based solutions, are directly in the crosshairs.

What Is an MFA Fatigue Attack?

The mechanics are deceptively simple. An attacker obtains a user’s username and password — through phishing, credential stuffing from a leaked database, or purchasing credentials on a darknet market. With valid credentials in hand, they repeatedly trigger authentication push notifications to the victim’s registered device, often dozens of times in rapid succession, sometimes in the middle of the night.

The goal is not to crack the MFA code. The goal is to exhaust the user’s patience. After receiving the twentieth push notification in fifteen minutes, many users — particularly those who are tired, distracted, or frustrated — tap “Approve” just to make the notifications stop. At that moment, the attacker has full access to the account.

Variants of the attack layer social engineering on top: attackers call the victim, impersonate IT helpdesk staff, and say something like, “We are running a security audit — please approve the push notification we just sent.” The victim, now believing this is a legitimate IT request, complies willingly.

Why Indian Enterprises Are Particularly Exposed

The risk for Indian organisations is elevated for several structural reasons:

• Hybrid and remote workforce: Post-pandemic work patterns mean employees are scattered across home offices, co-working spaces, and branch locations. Security teams have less contextual visibility into whether a late-night authentication attempt is a legitimate user or an attacker in another country.
• High helpdesk volumes and social engineering norms: Indian enterprise IT helpdesks handle large volumes of authentication-related requests. Employees are conditioned to expect identity verification calls from IT, making social-engineering lures more convincing than in environments where such calls are rare.
• Overreliance on older push MFA configurations: Many organisations rolled out push-based MFA years ago and have not upgraded to newer controls like number matching, additional context, or phishing-resistant FIDO2 keys. These older configurations are the most vulnerable to fatigue techniques.
• Credential exposure from third-party breaches: India consistently ranks among the top countries for credentials appearing in global breach databases. An attacker who has a valid username and password only needs a single push approval to turn a leaked credential into an active intrusion.

The Attack Kill Chain

Understanding the attack progression helps security teams identify where controls can break the chain:

1. Credential acquisition: Purchased from breach compilations, harvested via phishing kit, or extracted through infostealer malware prevalent in campaigns targeting Indian enterprises.
2. Initial push flood: Automated tooling sends repeated authentication requests, triggering push notifications to the victim device.
3. Social engineering (optional but common): The attacker calls the victim, building urgency and legitimacy to prompt approval of the next push notification.
4. Account takeover: Push approved. The attacker lands on corporate email, VPN, or cloud applications.
5. Lateral movement: With email access, the attacker pivots to password resets, impersonates the compromised user over Teams or Slack, and potentially initiates invoice fraud targeting finance teams.
6. Persistence: New MFA devices registered, conditional access policies modified, inbox forwarding rules added — making re-entry trivial even after initial detection and password reset.

CERT-In Reporting Obligations

India’s Computer Emergency Response Team (CERT-In) issued direction 20(3)/2022-CERT-In in April 2022, requiring organisations in critical sectors to report cybersecurity incidents — including unauthorised account access — within six hours of detection. An MFA-bypass-driven account takeover that touches corporate email or cloud infrastructure qualifies as a reportable incident under this directive.

The six-hour window is demanding. From the moment your SOC analyst detects an anomalous login, you have less than a working shift to investigate, contain, and notify. That timeline is achievable only if detection and response processes are automated — not when analysts are manually correlating logs across disconnected systems. For organisations without in-house coverage, a managed SOC as a Service with round-the-clock 24/7 monitoring ensures anomalous sign-ins are investigated the moment they occur — not the next morning.

Defensive Controls: What Actually Works

Defending against MFA fatigue requires layered controls across identity, network, and endpoint. Here is a prioritised checklist for Indian enterprise security teams:

Identity and Authentication Hardening

• Enable number matching immediately: Microsoft Authenticator and many enterprise MFA platforms now support number matching, requiring the user to enter a two-digit code displayed in the login request into their phone app. This eliminates blind push approvals and is the single highest-impact control at zero additional cost for existing deployments.
• Add geographic and app context to push notifications: A push notification showing “Login attempt from Frankfurt, Germany to your corporate email” is far less likely to receive an accidental approval than a generic prompt.
• Migrate high-privilege accounts to phishing-resistant MFA: FIDO2 hardware security keys (YubiKey, Feitian) or platform authenticators eliminate push approvals entirely. Mandate these for all domain admins, privileged users, and C-suite accounts as the first step.
• Implement risk-based Conditional Access: Deny or require additional verification for logins from unfamiliar locations, unknown devices, or outside business hours. Risk-based policies can block high-risk sign-in attempts before a push is ever triggered.
• Rate-limit MFA push requests: Temporarily lock accounts after a threshold of failed MFA attempts within a short window to disrupt flood-based attacks.

Zero Trust Network Access

Even if an attacker succeeds in stealing an authenticated identity, Zero Trust Network Access (ZTNA) limits the damage. ZTNA enforces least-privilege access to applications: a compromised account can only reach the specific applications it is authorised for, from a device that meets the security posture baseline. It cannot freely traverse the network or access resources beyond its defined scope.

PJ Networks deploys Fortinet’s ZTNA solution — integrated with FortiGate and FortiClient — as part of its managed security portfolio. For clients who have experienced MFA-bypass incidents, ZTNA reduces blast radius by preventing lateral movement from a compromised identity. Combined with continuous device posture checks, even a valid session token obtained through MFA fatigue grants no unrestricted network access.

SOC Detection Rules

• Alert on impossible travel: a single user authenticating from Mumbai and then from an overseas location within thirty minutes.
• Alert on push flooding: more than five push notifications to a single account within ten minutes is a strong indicator of an active fatigue attempt.
• Monitor for post-compromise indicators: new inbox forwarding rules, newly registered MFA devices, bulk email access or large downloads shortly after login.
• Cross-correlate identity events with endpoint and network telemetry — a clean authentication log does not mean a clean endpoint.

PrahiX Ora: Unified SecOps for Identity Threat Response

Detecting and responding to MFA fatigue attacks at scale requires a SecOps platform that can ingest identity signals alongside network, endpoint, and cloud telemetry and surface meaningful, correlated alerts in near real-time. For our clients, PJ Networks deploys and operates PrahiX Ora, a unified SecOps platform built by PrahiX Tech Pvt Ltd. As its primary field deployment and operations partner, PJ Networks brings Ora to enterprise environments across India. Here is how each pillar of the platform strengthens your defence against identity-based attacks:

SIEM — Correlation and Attack Storyline Reconstruction: PrahiX Ora’s SIEM ingests logs from identity providers (Entra ID, Okta, Google Workspace), FortiGate, endpoint agents, and cloud platforms. Correlation rules are mapped to MITRE ATT&CK tactics — specifically Credential Access and Initial Access — and trigger alerts when push-flood patterns or impossible-travel sequences are detected. Graph-based attack storyline reconstruction links authentication events to subsequent mailbox activity, network connections, and file access, giving analysts a complete picture rather than isolated signals. Tiered retention (hot, cold, and archive) supports CERT-In’s 180-day in-country log retention direction, ensuring you have the historical depth needed for regulatory response and forensic investigations.

NMS — Network Visibility Across Multi-Vendor Estates: Once an attacker has a foothold in an identity, they probe the network. PrahiX Ora’s Network Management System provides unified observability across firewalls, switches, access points, and WAN/SD-WAN links. LLDP/CDP topology discovery maps the network automatically; ML-based anomaly detection flags unusual lateral movement — a compromised account accessing servers it has never touched, or an endpoint scanning internal subnets. For Indian enterprises with fragmented NOC visibility across multi-vendor estates, this single-pane view closes a critical blind spot.

Video Surveillance (VMS) — Physical-Digital Security Correlation: For manufacturing, retail, and multi-site organisations, PrahiX Ora’s video surveillance (VMS) capability — supporting ONVIF, Hikvision, and Dahua cameras with video analytics — allows physical and network security events to be correlated in one operations view. An after-hours authentication from a facility that shows no staff present on camera is a meaningful red flag that siloed physical and IT security systems cannot surface. This is particularly relevant for Indian enterprises managing distributed estates where the physical and digital threat surfaces have historically been managed separately.

SOAR — Automated Response Within the CERT-In Window: The SOAR capability runs playbook automation with pre-built connectors and automated response actions. For an MFA fatigue event in progress, a response playbook can automatically disable the targeted account, revoke active sessions, and push an updated IP blocklist to FortiGate — all within minutes of alert generation. This level of automation is what makes CERT-In’s six-hour incident reporting window realistic in practice. By the time your analyst begins drafting the notification, containment has already progressed significantly. To explore how PrahiX Ora could be deployed and operated in your environment, reach out to PJ Networks for an assessment.

Incident Response Playbook

If your SOC detects a potential MFA fatigue attack in progress, here is the recommended immediate response sequence:

Detection (0–15 minutes)

• Automated alert fires on high-volume push requests or impossible-travel event.
• SOC analyst reviews authentication logs and confirms the pattern is consistent with an active fatigue attack.
• Determine whether any push notifications have been approved within the flood window.

Containment (15–45 minutes)

• Immediately disable the targeted account or force a password reset and session invalidation.
• Revoke all active sessions and refresh tokens for the account across all platforms.
• Block observed source IP ranges at the perimeter FortiGate firewall.
• If a successful login is confirmed: isolate the endpoint if network-accessible, escalate to a full incident response track, and preserve forensic artefacts.

Notification (45–360 minutes)

• If the incident meets the CERT-In threshold: prepare and submit the six-hour incident notification.
• Notify the affected user and their manager. Notify the CISO directly if a senior executive is involved.
• Conduct post-compromise forensics: inbox forwarding rules, OAuth application grants, new MFA device registrations, VPN session logs, and cloud access logs.

Priorities for This Quarter

Given the current threat landscape, here is a pragmatic prioritisation for Indian enterprise security teams:

1. Enable number matching this week — this is a configuration change, not a deployment project, and it is the fastest impact control available.
2. Mandate FIDO2 keys for the ten most sensitive accounts (domain admins, CFO, CISO, key IT administrators) within thirty days.
3. Review risk-based Conditional Access policies — block legacy authentication entirely and enforce step-up for high-sensitivity applications accessed from unfamiliar locations.
4. Validate SOC detection coverage for push flooding and impossible-travel patterns. If you manage your SOC through PJ Networks, engage your account team to tune these detection rules for your environment.
5. Time your incident response playbook — measure how long it actually takes to revoke sessions, isolate an account, and prepare a CERT-In notification, then automate the gaps.

Identity Is the New Perimeter

The security industry has said for years that identity is the new perimeter. MFA fatigue attacks make that statement operationally concrete. Threat actors no longer need to break through firewalls — they convince employees to hand over authenticated sessions. The defensive response must be equally identity-centric: phishing-resistant authentication methods, Zero Trust access controls, and continuous behavioural monitoring of every session.

For Indian enterprises navigating the dual pressures of DPDP Act compliance and CERT-In’s incident reporting requirements, a robust identity security posture is not optional — it is the foundation on which every other security investment depends.

PJ Networks helps Indian enterprises design, deploy, and operate identity-aware security architectures — from FortiGate-based ZTNA and FortiClient endpoint protection to 24/7 NOC/SOC monitoring. If your organisation is assessing its MFA posture or preparing for a DPDP or CERT-In compliance review, contact PJ Networks for a no-obligation security consultation.