New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

What Changed

Three separate research efforts presented last week showed ways around passkey protections without breaking the underlying cryptography. Each attack targets the systems around the passkey: logs, sync and recovery, or the Windows session that uses the key.

The Three Findings

• SpecterOps, Pass-the-Passkey: Michael Grafnetter presented at Black Hat USA on August 5. Windows stored past YubiKey signatures in cleartext that authenticated unprivileged users could read, tracked as CVE-2026-34348 in the Windows Event Logging Service (CVSS 6.5). Chained with weaknesses in Entra ID passkey validation, this allowed impersonation of privileged users despite phishing-resistant MFA policies. SpecterOps says Microsoft’s July Windows updates break the full chain, though it believes Entra’s use of JWTs as WebAuthn challenges still leaves room for assertion replay.
• Unit 42, Pass-ta-key: malware already on a Windows endpoint can abuse Google Password Manager in Chrome. The “Golden” variant targets the 32-byte Security Domain Secret that protects synced passkeys. With it, an attacker can recover synced private keys, and Unit 42 says the secret cannot currently be rotated or revoked.
• Dirk-jan Mollema: a low-privilege process in a compromised session can use a TPM-protected Windows Hello for Business key without a new PIN or biometric prompt. Because the Entra WebAuthn challenge is valid for five minutes and is not bound to a session, user or tenant, a challenge fetched elsewhere can be signed on the victim machine.

What Microsoft Said

Microsoft told The Hacker News it has “applied mitigations for the reported issue involving passkey relay assertions” and recommends least privilege, phishing-resistant authentication and endpoint protection. Starting September 1, 2026, Entra ID will automatically enable passkeys for users currently set up for SMS or voice authentication.

What To Verify First

• Install the Windows updates for CVE-2026-34348.
• Make sure relying parties enforce the user-verification flag they request.
• In Entra, monitor Windows Hello for Business sign-ins without a device ID and unexpected device registrations.
• Treat browser memory, passkey stores and recovery flows as credential material in endpoint detection.

What Teams May Be Underestimating

Passkeys still stop remote phishing. These attacks mostly matter after an endpoint is compromised, which is exactly when teams hope strong authentication will limit the damage.

Source Context

This item was rebuilt from the following primary sources and original reporting:

• The Hacker News: New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
• Unit 42: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

Related In The Daily Brief

See this item in The 5-Minute Cyber Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Attackers began exploiting SharePoint auth bypass CVE-2026-55040 after Rapid7 released a PoC; KEVIntel saw eight of 12 attempts on August…

GitLab CVE-2026-19478 Comes Under Active Exploitation Within Days of Disclosure

GitLab CVE-2026-19478 is not a minor project-integrity issue. It is a 9.4 unauthenticated code-injection path against public projects, which means…

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added CVE-2026-20316 to the Known Exploited Vulnerabilities catalog after active exploitation. The flaw affects Cisco Secure Firewall Management Center…