Passkey Attacks Bypass Phishing-Resistant MFA Without Breaking the Crypto

Three separate research efforts have shown ways to defeat passkey protections without cracking the cryptography they rest on, by attacking the endpoint and the session instead. One chain reuses signed authentication material to impersonate privileged users while still satisfying phishing-resistant multifactor authentication; another recovers the private keys for a victim's cloud-synced passkeys; a third abuses a hardware-bound Windows Hello for Business key from an already-compromised session without a fresh PIN or biometric. Microsoft has patched a related Windows logging flaw, CVE-2026-34348 (CVSS 6.5), and applied mitigations for passkey relay assertions. The research, disclosed the week of August 3, 2026, does not undermine passkeys as a phishing defense, but it does redraw where their protection ends.

The three findings differ in impact and should not be flattened into one scare. SpecterOps demonstrated a Windows and Microsoft Entra ID chain that could impersonate privileged users while satisfying phishing-resistant MFA; crucially, it reused signed authentication material rather than stealing the authenticator's private key. Unit 42 showed attacks against Google Password Manager in Chrome, including a path that actually recovers the private keys for a victim's synced passkeys, which is the most serious of the three because an extracted key is portable. Independent researcher Dirk-jan Mollema showed that malware already running in a signed-in Windows session can use a hardware-bound Windows Hello for Business key without prompting the user to unlock it again. None broke the math; all three assumed a foothold on the device or in the session.

That shared assumption is the real headline. Passkeys end adversary-in-the-middle proxy phishing, the class of attack that defeats one-time codes, and that remains true. What they do not do is insulate an identity provider from a compromised endpoint. Microsoft's Entra migration guidance, last updated August 3, 2026, still describes passkeys as resistant to replay attacks, which is accurate against a remote phisher and incomplete against malware sitting on the authenticated machine.

Do these attacks mean passkeys are broken?

No. The cryptography holds, and passkeys remain the strongest widely available defense against phishing. What the research shows is that "phishing-resistant" is not the same as "endpoint-proof." Once an attacker has code running in a user's session, the question shifts from authentication to session integrity and user verification, and current OS implementations often treat an unlocked session as proof of user intent. The gap is not in the passkey standard; it is in how implementations decide when to demand a fresh human check.

What should identity teams do now?

Deploy the Windows security update for CVE-2026-34348 and review access to Windows event-log subscriptions. Then tier your authentication: mandate hardware-bound, non-exportable FIDO2 security keys with per-sign-in PIN or biometric for administrators and other Tier 0 accounts, where a recovered synced key would be most damaging, while allowing synced passkeys for the general workforce on the assumption that endpoints are untrusted. On the server side, set WebAuthn policy to require user verification and reject assertions that lack it, and accelerate device-bound session credentials so a stolen assertion or cookie cannot be replayed off-device. Finally, shift weight from the moment of login to continuous access evaluation and endpoint detection, because these attacks live after authentication, not during it.

Our read

Understanding risk here means being precise about what changed. Passkeys did not fail; the boundary of what they protect got clearer, and it stops at the health of the endpoint and the session. That is a continuous-verification problem, not an authentication one: the signal that matters is whether the device is compromised and whether the session still reflects a present, verified human, evaluated continuously rather than confirmed once at login. Our review of 2025's exploited vulnerabilities found the median gap between disclosure and exploitation was 26 days, and endpoint-resident techniques like these tend to move faster once tooling circulates. Keep deploying passkeys, force user verification server-side, reserve hardware keys for your most privileged accounts, and treat every endpoint as a place an assertion could be abused.

Reporting by The Hacker News; technical details per SpecterOps, Unit 42, Dirk-jan Mollema, and Microsoft's advisory for CVE-2026-34348. Sources linked above.

Related: Chrome 150 use-after-free memory-safety bugs · Ubuntu snap-confine CVE-2026-8933 local root