[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fc8huJuUyY0M97dgrVh4Yy6kKJyaoRiNqC0EeptUDeVo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"b2f0d775-5b69-4911-9bca-90d4d805390b","passkey-attacks-bypass-phishing-resistant-mfa-without-breaking-cryptography","a13a6c38-2bc5-4817-b8e7-265c8bc3f9c1","Passkey Attacks Bypass Phishing-Resistant MFA Without Breaking Cryptography","Three independent research efforts revealed that passkey security can be undermined not by breaking cryptography, but by exploiting how authentication material is handled, synced, or exposed at the system level. Attackers can abuse signed authentication data in Windows to impersonate privileged users in Entra ID, extract synced private keys from Google Password Manager, or leverage hardware-bound keys from a compromised Windows session without re-authentication. This matters because organizations that deployed passkeys specifically to achieve phishing resistance may now have a false sense of security. The attacks highlight that strong cryptographic primitives are only as secure as the ecosystem—OS, browser, and identity provider—that surrounds them.","**Immediate actions:**\n- Audit and restrict which applications and processes can access authentication material on Windows endpoints (e.g., Windows Hello for Business key usage).\n- Enable Conditional Access policies in Microsoft Entra ID that enforce device compliance and anomaly detection beyond just MFA method.\n- Review and limit passkey sync settings in Google Password Manager and equivalent credential managers to reduce key exposure surface.\n\n**Long-term improvements:**\n- Adopt a defense-in-depth authentication strategy that combines passkeys with endpoint detection, session monitoring, and privilege tiering rather than treating passkeys as a single control.\n- Enforce Privileged Access Workstations (PAWs) for admin accounts to reduce the risk of malware accessing hardware-bound keys from a compromised session.\n- Regularly review vendor security advisories from Microsoft, Google, and identity providers to track changes in passkey implementation behavior.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tooling that flags unusual authentication token generation or credential manager API calls.\n- Monitor Entra ID sign-in logs for authentication events using signed data from unexpected device states or locations.\n- Establish behavioral baseline alerts for privileged account authentications that occur outside normal patterns or administrative workflows.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 6: Access Control Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-63B: Digital Identity Guidelines – Authenticator Assurance","NIST AC-2: Account Management","NIST AC-17: Remote Access","NIST IA-5: Authenticator Management","NIST IA-8: Identification and Authentication (Non-Organizational Users)","NIST SI-7: Software, Firmware, and Information Integrity","MITRE ATT&CK T1552: Unsecured Credentials","MITRE ATT&CK T1556: Modify Authentication Process","ISO\u002FIEC 27001 A.9.4: System and Application Access Control",{},"published","2026-08-10T14:21:06.13342+00:00","2026-08-10T14:21:05.845+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fnew-passkey-attacks-can-recover-synced.html","new-passkey-attacks-can-recover-synced-private-keys-or-bypass-phishing-resistant-cdcb04","New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":62,"name":63,"problem":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]