Skip to content
BreachPathAttack Path LibraryStart
FoundationalAccount takeover

MFA fatigue to Microsoft 365 takeover

With a valid password in hand, an attacker wears the user down with repeated approval prompts, registers their own authenticator for durable access, and takes over the Microsoft 365 account.

Technologies
Microsoft 365, Azure
Entry points
Stolen credentials, Phishing
Sectors
SaaS & technology, Professional services, Financial services…
Stages
3
01

A valid password is already held

The attacker starts with a valid password obtained from a prior breach or phishing, meaning the only remaining barrier is the multi-factor prompt.

Attacker objective

Have a working password so only the second factor stands in the way.

MITRE ATT&CK
Controls that should stop this
  • Breached-password screening and forced resets
  • Phishing-resistant MFA that cannot be approved by a simple tap
  • Conditional Access limiting where sign-in is even attempted
What defenders should see
  • Sign-in attempts with correct password from unusual locations
  • Credential matches against known-breached lists
  • Repeated authentication attempts for one account
What a pentest validates
  • Assess exposure of reused/breached passwords
  • Review whether MFA method resists prompt approval
  • Test Conditional Access coverage
Business impact

Only the second factor now protects the account.

02

The user is worn down with repeated prompts

The attacker triggers repeated approval prompts, relying on the user eventually approving one to make the notifications stop — a social weakness in push-only MFA.

Attacker objective

Get the user to approve a push notification out of confusion or fatigue.

MITRE ATT&CK
Controls that should stop this
  • Number-matching / context in MFA prompts, or phishing-resistant methods
  • Throttling and alerting on repeated MFA requests
  • User training to report unexpected prompts, never approve them
What defenders should see
  • Bursts of MFA requests for a single user
  • Repeated deny-then-approve patterns
  • MFA approvals from a location the device is not in
What a pentest validates
  • Test resilience to MFA prompt bombing (with consent)
  • Validate throttling and alerting on repeated prompts
  • Measure user reporting of unexpected prompts
Business impact

The attacker satisfies MFA and completes sign-in as the user.

03

The attacker registers their own factor and takes over

Once in, the attacker registers an additional authentication method under their control, so future logins succeed without bothering the user — cementing the takeover.

Attacker objective

Secure durable access that no longer depends on tricking the user.

MITRE ATT&CK
Controls that should stop this
  • Alerting on new MFA-method registration
  • Require step-up verification to add authentication methods
  • Revoke sessions and registered methods during compromise response
What defenders should see
  • Security-info / MFA-method registration events
  • New authenticator added shortly after an unusual sign-in
  • Changes to account recovery settings
What a pentest validates
  • Test whether a new MFA method can be added silently
  • Validate alerting on security-info changes
  • Confirm response removes attacker-registered methods
Business impact

The account is fully taken over, with attacker-controlled access that survives a password reset.

ATT&CK techniques in this chain

T1078.004Valid Accounts: Cloud AccountsT1098Account ManipulationT1556.006Modify Authentication Process: Multi-Factor AuthenticationT1621Multi-Factor Authentication Request Generation

If this chain completes

Full takeover of a cloud identity where weak MFA methods are in use — enabling data access, persistence and onward movement, and defeating the assumption that any MFA is enough.

Should you test this against your environment?

Turn this chain into a scoped red-team brief — objective, systems and identities in scope, testing assumptions and the questions to answer before commissioning.

Generate my red-team test briefExplore more paths