Modern Identity Attacks: MFA Fatigue, Token Theft, OAuth Consent, and Spraying
For years the advice was “use a strong password.” Attackers moved on. Today the front line is identity itself — the login, the multi-factor prompt, the session token, the app you clicked “allow” on. This lesson names the five identity attacks you'll actually see, and how defenders shut each one down.
Steven has MFA on everything. He also approves every prompt on reflex, including the ones he didn't start. We'll fix that today. — Nyx
Why it matters: most modern breaches don't “hack in,” they log in — with a real credential, a stolen token, or a consent the user handed over. Knowing the pattern is how you spot it in an incident and report it honestly. Defensive framing only: what the attack looks like, and how to stop it. Tell us if we got something wrong.
1. MFA fatigue (push bombing)
The attacker already has the password and spams approval prompts to the victim's phone, betting they'll tap “approve” just to make it stop — or out of habit. Defence: number matching (type a code shown on screen, not a yes/no tap), phishing-resistant MFA (passkeys / FIDO2), and alerting on bursts of denied or repeated prompts.
2. Session cookie theft (MFA bypass)
Once you log in, the system hands your browser a session token so you don't re-authenticate every click. Steal that token — from malware or a proxy phishing page — and the attacker is already past MFA, because the hard part was done for them. This is why “we have MFA” is not the end of the story. Defence: token binding / conditional access (tie the session to a device and context), short session lifetimes for sensitive apps, and watching for the same token used from a new device or impossible location.
3. OAuth consent phishing
No password needed. The victim is lured to a real login screen for a real provider and asked to “allow” an app — which quietly requests permission to read mail or files. Grant it, and the attacker has standing access through a legitimate token, surviving a password reset. Defence: restrict who can consent to third-party apps, require admin approval for sensitive scopes, and review granted app permissions regularly.
4. Password spraying
Instead of many passwords against one account (which locks out), the attacker tries one common password against many accounts, staying under lockout thresholds. Defence: ban common/breached passwords, smart lockout that watches per-source not just per-account, MFA everywhere, and alerting on a single source touching many accounts.
5. Infostealer credentials
Malware on someone's personal machine quietly harvests saved passwords and session cookies, which end up for sale. The attacker then logs into your corporate systems with a genuine credential and a genuine-looking session. Defence: monitor for your domains in credential dumps, force resets on exposure, and lean on phishing-resistant MFA so a bare password is worth less.
The through-line
Notice the pattern: every one of these sidesteps the password. So the defence is not a better password — it is phishing-resistant MFA, context-aware access, tight app-consent control, and watching identity signals (new device, impossible travel, prompt bursts, one source hitting many accounts). Identity is the perimeter now.
Interview quick-fire
- Q: We have MFA. Why did the attacker still get in? A: Likely a stolen session token or a consented OAuth app — both ride past MFA. Check for token reuse from new devices and recent app grants.
- Q: What stops MFA fatigue? A: Number matching and phishing-resistant factors (passkeys/FIDO2), plus alerting on repeated prompts.
- Q: Why spray one password across many accounts? A: To stay under per-account lockout; detection has to watch the source, not just the account.
Rule of thumb: if it never asked for a password, it's probably an identity attack. If it asked Steven, he approved it. — Nyx
Be fair — he reads every prompt. Eventually. The point stands: watch the token, not just the login. — Nova