Podcast Summary: Hacking Humans – "MFA prompt bombing (noun) [Word Notes]"

Podcast: Hacking Humans
Host: N2K Networks
Episode Title: MFA prompt bombing (noun) [Word Notes]
Episode Date: January 13, 2026

Overview

This episode of Word Notes on Hacking Humans dives into the cybercrime technique known as "MFA prompt bombing." The primary focus is on how attackers exploit human behavior to bypass multi-factor authentication (MFA) by bombarding users with repeated authentication prompts, leading them to eventually approve access out of annoyance or confusion. The episode explains the technical method, real-world examples, notable threat actors, and even draws a pop culture parallel to illustrate the concept.

Key Discussion Points & Insights

What is MFA Prompt Bombing?

• Definition:
  MFA prompt bombing involves flooding a user's device with repeated MFA prompts. Attackers who possess a compromised username and password repeatedly attempt to log in, generating a “blizzard” of authentication requests (01:23).

• Purpose:
  The hope is the legitimate user will, out of frustration or confusion, approve one of the prompts, granting attackers access.

  "Hackers bypass multi factor authentication schemes by sending a blizzard of spamming login attempts until the account's owner accepts the MFA prompt out of desperation to make the spamming stop."
  — Tim Nodar (01:33)

• Behavioral Exploit:
  The attack works because people dislike being pestered or inconvenienced, especially while tired or busy. Victims may assume it's merely an error or a legitimate IT process.

Real-World Tactics & Examples

• Case Example:
  "In the middle of the night, the victim, after receiving hundreds of MFA prompts on his phone, validated access to his account and went back to bed." — Tim Nodar (01:45)
• Threat Actor Insights:
  • Lapsus$ Quote:
    Dan Gooding of Ars Technica referenced a Lapsus$ member stating:

    "No limit is placed on the amount of calls that can be made. Call the employee 100 times at 1am or while he's trying to sleep, and he will more than likely accept it." — Quoted by Tim Nodar (03:10)

  • Nation-State Usage:
    Russian cyber-espionage group APT29 (Cozy Bear) has been documented using MFA prompt bombing in targeted attacks, as observed by Mandiant researchers (03:30).

Pop Culture Illustration (Nerd Reference)

• Sneakers (1992) Analogy: The podcast draws a parallel between the attack and a scene from the classic hacker film "Sneakers."
  • Setup: River Phoenix and Robert Redford's characters attempt to get past a security guard, overwhelming him with simultaneous demands, confusion, and manufactured urgency.
  • Parallel: The security guard, much like MFA users, faces an onslaught and ultimately complies just to make the problem go away.
  • Quote:

    "Thanks. And that's MFA prompt bombing in the real world." — Tim Nodar (05:39)

Human Factors in Security

• Key Insight:
  The episode emphasizes that technology alone can’t secure systems if human response to unexpected annoyances is to simply give in and approve requests.

Memorable Quotes & Moments

• On Annoyance as an Attack Vector:

  "This hacking technique takes advantage of the fact that we all hate to be annoyed and inconvenienced."
  — Tim Nodar (02:10)

• Lapsus$ Member Tactics:

  "Call the employee 100 times at 1am or while he's trying to sleep, and he will more than likely accept it."
  — Quoted by Tim Nodar (03:14)

• Sneakers Film Comparison:

  "That's when Redford walks past the guard, up to the electronic door that's locked carrying a bundle of helium balloons and a birthday cake box and starts yelling at the guard to let him in."
  — Tim Nodar (05:17)

• Summary:

  "That's MFA prompt bombing in the real world."
  — Tim Nodar (05:39)

Notable Timestamps

• 01:23 — Definition and explanation of MFA prompt bombing
• 02:10 — Exploitation of human behavior (annoyance and confusion)
• 03:10–03:30 — Quoting Lapsus$ and referencing APT29’s use of this technique
• 04:52–05:39 — "Sneakers" movie analogy and live-action play-by-play
• 05:39 — Episode summary statement linking the analogy to modern cybercrime

Conclusion

The episode succinctly explains how MFA prompt bombing manipulates the weakest element in any security protocol: the human user. By overwhelming them with authentication prompts, attackers exploit user fatigue, inconvenience, and confusion to gain unauthorized access—often with startling ease. The "Sneakers" analogy grounds the abstract concept in a relatable, memorable cultural reference, driving home the importance of user vigilance and the limits of technical solutions alone.