Lapsus$ and the group behind the SolarWinds hack have utilized prompt bombing to defeat weaker MFA protections in recent months. One technique involves sending a bunch of MFA requests and hoping the target accepts one to make the notifications stop.