It is 3:15 AM, and your smartphone begins buzzing relentlessly on your nightstand. Screen notification after screen notification appears in rapid succession: "Sign-in request: Microsoft account," "Did you just try to sign in to PlayStation Network?", or "Ubisoft 2-Step Verification request." Fifty approval prompts flood your phone over the course of ten minutes. Drowsy, frustrated, and assuming an authentication server has encountered an endless loop, you reach over and tap "Approve" just to make the incessant buzzing stop.
Within ninety seconds, your primary email address is removed from your account, your password is changed, your authenticator is revoked, and your gaming library — representing thousands of dollars in games, downloadable content, and years of progress — is stolen.
This attack is known as MFA Fatigue, also referred to as Push Bombing or Prompt Exhaustion. As gamers increasingly protect their accounts with two-factor authentication (2FA/MFA), cybercriminals have adapted. Instead of attempting to breach cryptographic tokens, attackers exploit human psychological vulnerabilities to bypass secondary verification barriers.
The Anatomy of an MFA Fatigue Attack
MFA fatigue does not happen by chance; it represents the final stage of a targeted credential-stuffing operation:
- Credential Harvest: Attackers obtain your email and password combination from historical third-party data breaches (such as compromised gaming forums, e-commerce leaks, or Discord credential dumps).
- The Secondary Barrier: The attacker inputs your valid credentials into the storefront login portal (such as Microsoft/Xbox, Sony PSN, or Ubisoft). Because you have two-factor authentication enabled, the server pauses the login and transmits an authentication challenge to your registered mobile device.
- Automated Bombardment: Rather than giving up, the attacker runs an automated script that attempts to sign in every few seconds. This triggers a relentless flood of push notifications, authorization dialogs, and verification requests to the victim's smartphone.
- Psychological Exploitation: Attackers deliberately launch these attacks during sleeping hours or during peak gaming sessions when attention is divided. The goal is simple: wear down the victim's resistance until they accidentally tap "Approve," misinterpret the prompts as a system bug, or approve the request out of sheer frustration to silence their phone.
What Happens in the First 60 Seconds Post-Approval
Tapping "Approve" grants the attacker an authenticated session token with full account management rights. Automated hijacking bots execute a standardized sequence within seconds:
- Primary Alias Modification: On platforms like Microsoft accounts, attackers immediately add a new outlook.com alias, designate it as the primary alias, and delete your original email address. This instantly severs your ability to initiate a password reset.
- De-authorizing Existing Authenticators: The attacker registers their own hardware security key or authenticator app and revokes your mobile device, generating new one-time backup recovery codes.
- Payment and Asset Stripping: Stored credit cards, PayPal links, and wallet funds are immediately drained through the purchase of digital game codes, gift cards, or high-tier virtual currencies that are gifted to third-party mule accounts.
- Console and Platform Unlinking: Attackers unlink active PlayStation, Xbox, and Steam hardware associations, locking your physical consoles out of your purchased digital game library.
Platform Differences and Protective Architectures
Understanding how different gaming platforms manage secondary verification reveals which accounts are most vulnerable to push bombing:
1. Microsoft and Xbox: The Power of Number Matching
Standard "Approve / Deny" push prompts are the primary vector for MFA fatigue. To neutralize this vulnerability, Microsoft updated its authenticator framework to enforce Number Matching. When a sign-in is attempted, the browser screen displays a random two-digit number. The user must manually type that exact number into the mobile authenticator app. Because a remote attacker cannot see what number appears on the victim's screen, blind push approval is impossible. Furthermore, Microsoft accounts support going completely "Passwordless," eliminating password credential stuffing altogether.
2. PlayStation Network: Moving Beyond SMS
PlayStation Network offers two-step verification via SMS text messages or third-party authenticator apps (such as Google Authenticator). SMS verification is highly vulnerable to push spamming and SIM-swapping. Transitioning to a Time-Based One-Time Password (TOTP) authenticator app eliminates push bombing, because TOTP apps generate local six-digit codes that cycle every 30 seconds without generating push notifications.
3. Steam: The Resilience of Steam Guard
Valve's Steam Guard mobile authenticator was engineered from the beginning to avoid blind push approvals for desktop logins. Logging into Steam requires either scanning an encrypted on-screen QR code with the Steam mobile app or manually entering a five-character alphanumeric TOTP code generated locally on the phone. While trade confirmations and community market listings generate push notifications, initial account logins cannot be bypassed through blind tap fatigue.
4. Ubisoft Connect and EA Account
Ubisoft and EA utilize email codes and authenticator apps. If you receive an unexpected verification email or app prompt from Ubisoft or EA, an attacker is actively entering your valid password on their login screen at that exact moment.
Immediate Emergency Response: What to Do Under Active Bombardment
If your smartphone is currently experiencing an active barrage of authentication prompts, execute these emergency containment steps immediately:
- Never Tap Approve: Tap "Deny," and if prompted, select "This wasn't me" or "Report fraudulent activity."
- Recognize the Underlying Compromise: A push bomb means the attacker already has your correct username and password. Denying the prompt only holds the door shut temporarily; you must change your master password immediately.
- Change Password from a Clean Device: Open a browser on a secondary device or PC, navigate directly to the platform's official security settings, and update your password to a unique, randomly generated passphrase of 16 characters or more.
- Terminate All Active Sessions: Locate the "Sign out everywhere" or "Deauthorize all other sessions" button in your account security dashboard. This instantly invalidates any temporary access tokens the attacker may have generated.
- Audit Linked Accounts and Aliases: Verify that no unfamiliar email addresses, phone numbers, or third-party console profiles have been linked to your account profile.
When investigating sudden midnight verification spams targeting console and PC libraries, 365Finds' account security guides advise treating repeated authentication prompts as proof that primary credentials have already been breached.
Account Hardening Checklist
- Enable Number Matching or TOTP: Replace simple one-tap push notifications with number matching or local authenticator apps that generate rolling time-based codes.
- Eliminate Password Reuse: Ensure your gaming accounts do not share passwords with external gaming forums, Discord bots, or secondary websites.
- Store Offline Backup Codes: Download the platform's one-time recovery codes and store them in an encrypted password vault or written in a physical notebook, never in cloud screenshots.
- Remove Unused Payment Methods: Set a mandatory purchasing PIN on console stores and avoid keeping auto-billing cards attached to accounts without strict checkout verification.