Multi-factor authentication fatigue attack detection and blocking

A non-transitory machine readable medium having program code stored thereon, the program code comprising instructions to:

• based on detecting a failure event to a first multi-factor authentication (MFA) challenge for a user, track failure events to subsequent MFA challenges for the user;
• identify an MFA implementation indicated in a message corresponding to the failure event;
• select a first of a plurality of fatigue attack detection rules that maps to the identified MFA implementation, wherein the plurality of fatigue attack detection rules maps to a plurality of MFA implementations which include the identified MFA implementation;
• determine whether the tracked failure events collectively satisfy the first fatigue attack detection rule;
• and
• based on a determination that the failure events collectively satisfy the first fatigue attack detection rule, perform a security action defined for the first fatigue attack detection rule.

An apparatus comprising:

• a processor;
• and
• a non-transitory machine-readable medium having stored thereon instructions executable by the processor to cause the apparatus to,
• monitor for multi-factor authentication (MFA) failure events;
• based on detection of a failure event to a first MFA challenge for a user, track failure events to subsequent MFA challenges for the user;
• identify an MFA implementation indicated in a message corresponding to the failure event;
• select a first of a plurality of fatigue attack detection rules that maps to the identified MFA implementation, wherein the plurality of fatigue attack detection rules maps to a plurality of MFA implementations which include the identified MFA implementation;
• determine whether the tracked failure events collectively satisfy the first fatigue attack detection rule;
• and
• based on a determination that the failure events satisfy the first fatigue attack detection rule, generate an alert indicating detection of a likely fatigue attack targeting the user.