MFA Fatigue and Push-Bombing

The attacker already has your password

Push-bombing only works because the attacker got past the first factor. They spam approval prompts, betting that annoyance or confusion makes you tap yes. One tap is all it takes.