Scattered Spider MFA Push Bombing Impossible Travel – Multi-Country 10m Window

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•2

Detects rapid succession of MFA authentication requests originating from multiple distinct countries within a 10-minute window, a common pattern indicating an MFA fatigue (push bombing) attack targeting a specific user.