Do NOT Accept a OKTA Push if You Don’t Initiate It

OKTA Fatigue, or MFA (multi-factor authentication) fatigue (aka MFA Prompt Spamming/MFA bombing) occurs when you’ve gotten so used to hitting “Accept” when a push comes through, you do it automatically even if you don’t initiate the push. It also occurs when you are bombarded with push notifications and you just want it to stop, so you finally accept it. Both scenarios are usually bad actors who already have your compromised credentials and need to get through that final layer of protection to get to your information.

There has been a rise in attacks targeting people’s direct information.

• Credentials are stolen, sometimes by guessing weak passwords or through a phishing attack.
• The bad actors log in, which initiates a OKTA push to the user. Either because of continual pushes or because the user is not paying attention, they accept the push, letting the bad actors in.
• The bad actors then add their own device to OKTA so going forward, they will get push notifications instead of the legitimate person.
• The bad actors get into the email account of the person and make a forwarding rule so any communication they initiate is forwarded to them and the person never sees it.

All because they accepted a OKTA Push they didn’t ask for. This isn’t a fake scenario to scare you. This has happened to multiple people.

DO NOT ACCEPT A OKTA PUSH UNLESS YOU START THE REQUEST! Reject the push. If you start to get constant push notifications, contact the IT Service Desk and let us know you might be under attack.

Stay safe and secure,

The AVOXI IT Team