Lapsus$ initiates the attack by bombarding a contractor's MFA with repeated requests, causing fatigue and eventual approval. This technique is aimed at bypassing multi-factor authentication through repeated attempts, leading the target to inadvertently approve access.