New Passkey Attacks Recover Synced Keys and Bypass Phishing-Resistant MFA

Three independent research efforts disclosed last week have shown that passkey implementations, long promoted as the cryptographic successor to passwords, can be defeated without ever cracking the underlying math. Instead, the attacks reused signed authentication material that Windows had logged to disk, abused a cloud-synced passkey system from malware already running on the victim's machine, and leveraged a hardware-bound Windows Hello for Business key from a compromised user session without requiring a fresh PIN or biometric prompt. The findings underscore that the practical security of passkeys depends heavily on the platform that stores and presents them, and users reviewing their credential hygiene can start with a password checker to identify any weak reusable logins still in use.

SpecterOps demonstrated the most alarming chain, a Windows-to-Microsoft Entra ID relay attack presented by principal security researcher Michael Grafnetter at Black Hat under the title "Pass-the-Passkey." The technique impersonated privileged users while satisfying phishing-resistant MFA by replaying signed WebAuthn assertions that Microsoft's Windows Event Logging Service had inadvertently exposed. Microsoft assigned the logging flaw CVE-2026-34348, rated 6.5 on the CVSS scale, and shipped a fix in its July 2026 updates; SpecterOps told The Hacker News it considers the full chain broken because the patched event logs are no longer usable for replay. Separately, Unit 42 showed attacks against Google Password Manager in Chrome that include a path capable of recovering the private keys for a victim's synced passkeys, while independent researcher Dirk-jan Mollema proved malware already executing inside a signed-in Windows session can invoke a hardware-bound Windows Hello for Business key without prompting the user to unlock it again.

Microsoft confirmed it has applied additional mitigations for the Entra-side passkey relay assertions beyond the Windows patch, though it declined to share technical details about those server-side changes. "We have applied mitigations for the reported issue involving passkey relay assertions and continue investing in security enhancements across authentication methods," a Microsoft spokesperson said, reiterating its Zero Trust and phishing-resistant authentication guidance. The Unit 42 and Mollema findings make clear that simply choosing between synced and device-bound passkeys does not close the broader attack surface; defenders must also harden the endpoint and the identity provider. Anyone concerned about credential exposure from the synced-passkey research can verify their accounts against known incidents using an email breach checker, and run a broader privacy checkup to review how authentication data is handled across their environments.