Passkey Attacks Bypass Phishing-Resistant MFA Without Breaking Cryptography
Written by AI from the linked story. Not reviewed by an editor. How this works
Three independent research efforts revealed that passkey security can be undermined not by breaking cryptography, but by exploiting how authentication material is handled, synced, or exposed at the system level. Attackers can abuse signed authentication data in Windows to impersonate privileged users in Entra ID, extract synced private keys from Google Password Manager, or leverage hardware-bound keys from a compromised Windows session without re-authentication. This matters because organizations that deployed passkeys specifically to achieve phishing resistance may now have a false sense of security. The attacks highlight that strong cryptographic primitives are only as secure as the ecosystem—OS, browser, and identity provider—that surrounds them.
Tactical Insight
Immediate actions
- Audit and restrict which applications and processes can access authentication material on Windows endpoints (e.g., Windows Hello for Business key usage).
- Enable Conditional Access policies in Microsoft Entra ID that enforce device compliance and anomaly detection beyond just MFA method.
- Review and limit passkey sync settings in Google Password Manager and equivalent credential managers to reduce key exposure surface.
Long-term improvements
- Adopt a defense-in-depth authentication strategy that combines passkeys with endpoint detection, session monitoring, and privilege tiering rather than treating passkeys as a single control.
- Enforce Privileged Access Workstations (PAWs) for admin accounts to reduce the risk of malware accessing hardware-bound keys from a compromised session.
- Regularly review vendor security advisories from Microsoft, Google, and identity providers to track changes in passkey implementation behavior.
Detection measures
- Deploy endpoint detection and response (EDR) tooling that flags unusual authentication token generation or credential manager API calls.
- Monitor Entra ID sign-in logs for authentication events using signed data from unexpected device states or locations.
- Establish behavioral baseline alerts for privileged account authentications that occur outside normal patterns or administrative workflows.