MFA Fatigue and Password Attacks
| Attack type | Credential attacks |
| Threat actors | Botnets, access brokers and any attacker holding a stolen password |
| Coverage since | October 20, 2026 |
| Platforms | Microsoft Entra ID |
The password is often already gone. Credential dumps, infostealers and reused passwords mean many attackers arrive with the right password in hand. What stands between them and the account is MFA, Conditional Access — and whether anyone notices them trying.
The threat
- Push bombing. The attacker has the password and sends MFA push after MFA push, hoping the user approves one just to make it stop.
- Slow brute force. Botnets spread their guesses so that each address makes only one attempt — invisible to any rule that counts failures per IP.
- The right password, the wrong place. Conditional Access blocks a sign-in from an unmanaged device or a blocked country — but only after the correct password was entered. Whoever tried knows the password.
How Fluency catches it
- MFA fatigue. More than two MFA denials or timeouts for one user in an hour raise an alert — and so does a user reporting a prompt as fraud.
- Brute force, counted per user. Fluency counts failed sign-ins against each user, from any number of addresses, so a botnet that sends one attempt per IP is still caught. Password spraying across many users from one address is summarized in a daily report.
- Correct password, blocked sign-in. When Conditional Access stops a sign-in right after the correct password, Fluency flags it: the password is compromised, even though the attacker got nowhere this time.
- Microsoft's own risk signal. Sign-ins that Entra ID Protection rates high risk at sign-in time are raised too, alongside everything else Fluency knows about the user.
Detections included
| Detection | What it catches |
|---|---|
EntraID_MFA_Fatigue | More than 2 MFA denials or timeouts for one user in an hour. High. |
EntraID_MFA_Fraud_Reported | A user reporting an MFA prompt as fraud. High. |
EntraID_Brute_Force_User | More than 15 failed interactive sign-ins for one user in an hour, from any number of IPs. Medium. |
EntraID_Valid_Password_Blocked | Conditional Access blocking a sign-in right after the correct password. Medium. |
EntraID_High_Risk_SignIn | A sign-in Entra ID Protection rates high risk. High. |
MITRE ATT&CK
| Tactic | Technique |
|---|---|
| Credential Access | T1621 Multi-Factor Authentication Request Generation |
| Credential Access | T1110 Brute Force |
| Initial Access, Persistence | T1078.004 Valid Accounts: Cloud Accounts |
Get this coverage
The detections are on every Fluency instance and need the Entra ID sign-in logs, collected through Azure Event Hubs or Microsoft Graph. Entra ID sign-in logs require an Entra ID P1 or P2 licence.
Not a customer yet? Start a free trial or book a demo.
Related
- Storm-2755: AiTM session theft — when the attacker skips the password and steals the session instead.
- Entra ID Detection Update — the full release, with triage guidance for each alert.