🟠 High | Source: The Hacker News
Three independent research teams have demonstrated practical attacks against passkeys that bypass their phishing-resistance without breaking the underlying cryptography. The techniques include extracting cloud-synced private keys from a compromised machine, replaying signed authentication material exposed by Windows, and abusing a legitimate passkey flow to circumvent phishing-resistant MFA. This matters because passkeys are increasingly being positioned as a gold-standard replacement for passwords, and these findings show that implementation and sync-layer weaknesses can undermine that guarantee.
Security Architect’s Take: Review your organisation’s passkey deployment to understand whether synced (cloud-backed) or device-bound passkeys are in use — device-bound keys are significantly harder to exfiltrate. Where passkeys are used as a phishing-resistant MFA factor, ensure endpoint detection controls are in place, as several of these attacks require prior code execution on the victim’s machine; a compromised endpoint negates most authentication-layer protections regardless of credential type.
Original advisory: New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA