Most Popular Detection – Vishing/Rogue MFA Takeover/Helpdesk-Support Impersonation 2026: MFA Fatigue: 3+ Push Denials Followed by One Approval
Detects a suspected Multi-Factor Authentication (MFA) fatigue attack, characterized by a user denying three or more consecutive MFA authentication requests in a short period (10 minutes) followed by a successful authentication approval. This behavior often indicates an adversary bombarding a user with push notifications to eventually solicit an accidental or coerced approval.
YARA-L
