> They then sent a complicated jumble of computer code and asked me to run it as a command on my work laptop and report back what it said. They wanted to know what internal IT access I had to start planning their next steps once inside.

He should share that script for companies to protect themselves.

> As I held my phone in my hands, the screen filled with a new request every minute or so.

> I knew exactly what this was - a hacker technique known as MFA bombing. Attackers bombard a victim with these pop ups by attempting to reset a password or login from an unusual device.

> Eventually the victim presses accept either by mistake or to make the pop-ups go away. This is famously how Uber was hacked in 2022.

Authenticator apps should not give notifications, users must open them manually. In Denmark the government have followed this security practice for the authentication app MitID. In the beginning there was a lot of complaints, but now we know that is just how it works.