Beware of Pahalgam 'push bombing', warn cyber police

BENGALURU police have warned of a new cyber threat involving malware that abuses 'multi-factor authentication' (MFA) systems, hidden inside images and videos shared in the name of Pahalgam attack.

- RISHITA KHANNA @Bengaluru

The malware is disguised as content such as emotional posts urging users to "set this as your DP" or "watch this tourist's final message". Once downloaded, it triggers a tactic known as 'MFA fatigue', where repeated login prompts are sent to the victim's device in the hope that they will accidentally approve one, unknowingly granting attackers access to data.

Cyber police said the technique — also called "push bombing" — has been used in corporate breaches before, but this is the first time it's being deployed widely using emotionally charged content. MFA typically works by asking for an extra verification step — such as a one-time password sent via SMS or an approval prompt on the user's device — after the correct password is entered. But attackers have found a way to manipulate this system.