New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
New passkey attacks bypass phishing-resistant MFA by reusing signed authentication material.
Three independent research efforts have revealed new vulnerabilities affecting passkey security, allowing attackers to bypass phishing-resistant MFA. These attacks do not break the underlying cryptography but instead exploit how systems handle authentication material. One method, demonstrated by SpecterOps, abuses signed authentication data exposed by Windows to impersonate privileged users in Microsoft Entra ID. Another, by Unit 42, targets Google Password Manager in Chrome, with a path to recover synced private keys. A third, by Dirk-jan Mollema, shows malware on a compromised Windows session can use hardware-bound Windows Hello for Business keys without re-authentication.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThree independent research efforts revealed that passkey security can be undermined not by breaking cryptography, but by exploiting how authentication material is handled, synced, or exposed at the system level. Attackers can abuse signed authentication data in Windows to impersonate privileged users in Entra ID, extract synced private keys from Google Password Manager, or leverage hardware-bound keys from a compromised Windows session without re-authentication. This matters because organizations that deployed passkeys specifically to achieve phishing resistance may now have a false sense of security. The attacks highlight that strong cryptographic primitives are only as secure as the ecosystem—OS, browser, and identity provider—that surrounds them.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-34348