What happened
- CISA advisory AA23-320A (first published Nov 16, 2023; updated Jul 29, 2025) describes "repeated MFA notification prompts leading to employees pressing the 'Accept' button" and help-desk social engineering.
- Microsoft Learn states: "Based on Microsoft's analysis more than 97 percent of credential stuffing attacks use legacy authentication and more than 99 percent of password spray attacks use legacy authentication protocols".
- Microsoft Learn also says legacy protocols "don't support multifactor authentication."
Root cause, per the sources
This is guidance and a statistic, not a single incident. The sources describe prompt fatigue, help-desk social engineering, and legacy protocols that cannot use MFA.
The exposure behind it
Where legacy authentication is allowed, a password alone can be enough. Where MFA coverage is partial, some accounts are protected only by a password.
What PixelPrivate can check
Microsoft 365 connector (new)New
Checks whether legacy authentication is blocked and reports MFA registration coverage, for example "Administrators without MFA".
Learn moreWhat PixelPrivate cannot do
- PixelPrivate does not detect intrusions, fraud or active attacks. It performs passive external checks and reports exposures.
- We cannot see push-bombing, meaning repeated MFA prompts sent to a user.
- We cannot claim that PixelPrivate would have prevented this incident, and we do not claim that.
What to do this week
- Block legacy authentication in your Microsoft 365 tenant.
- Check that every account, starting with administrators, is registered for MFA.
- Train staff to decline unexpected MFA prompts and report them.
- Verify caller identity before the help desk resets MFA.
Sources
- CISA, “Advisory AA23-320A”, First published Nov 16, 2023; updated Jul 29, 2025. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
- Microsoft Learn, “Block legacy authentication”, Undated page. https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-block-legacy-authentication
Last reviewed 2026-10-06. Figures are quoted as reported by the cited source.
Related hypothetical scenarios
Questions about this incident
What is MFA fatigue?
CISA describes repeated MFA notification prompts leading to employees pressing the Accept button.
Why does legacy authentication matter?
Microsoft Learn says legacy protocols do not support multifactor authentication.
Can PixelPrivate see MFA push-bombing?
No. The connector checks legacy authentication blocking and MFA registration coverage.
