What Changed
Three separate research efforts presented last week showed ways around passkey protections without breaking the underlying cryptography. Each attack targets the systems around the passkey: logs, sync and recovery, or the Windows session that uses the key.
The Three Findings
- SpecterOps, Pass-the-Passkey: Michael Grafnetter presented at Black Hat USA on August 5. Windows stored past YubiKey signatures in cleartext that authenticated unprivileged users could read, tracked as CVE-2026-34348 in the Windows Event Logging Service (CVSS 6.5). Chained with weaknesses in Entra ID passkey validation, this allowed impersonation of privileged users despite phishing-resistant MFA policies. SpecterOps says Microsoft’s July Windows updates break the full chain, though it believes Entra’s use of JWTs as WebAuthn challenges still leaves room for assertion replay.
- Unit 42, Pass-ta-key: malware already on a Windows endpoint can abuse Google Password Manager in Chrome. The “Golden” variant targets the 32-byte Security Domain Secret that protects synced passkeys. With it, an attacker can recover synced private keys, and Unit 42 says the secret cannot currently be rotated or revoked.
- Dirk-jan Mollema: a low-privilege process in a compromised session can use a TPM-protected Windows Hello for Business key without a new PIN or biometric prompt. Because the Entra WebAuthn challenge is valid for five minutes and is not bound to a session, user or tenant, a challenge fetched elsewhere can be signed on the victim machine.
What Microsoft Said
Microsoft told The Hacker News it has “applied mitigations for the reported issue involving passkey relay assertions” and recommends least privilege, phishing-resistant authentication and endpoint protection. Starting September 1, 2026, Entra ID will automatically enable passkeys for users currently set up for SMS or voice authentication.
What To Verify First
- Install the Windows updates for CVE-2026-34348.
- Make sure relying parties enforce the user-verification flag they request.
- In Entra, monitor Windows Hello for Business sign-ins without a device ID and unexpected device registrations.
- Treat browser memory, passkey stores and recovery flows as credential material in endpoint detection.
What Teams May Be Underestimating
Passkeys still stop remote phishing. These attacks mostly matter after an endpoint is compromised, which is exactly when teams hope strong authentication will limit the damage.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Source Context
This item was rebuilt from the following primary sources and original reporting:
- The Hacker News: New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
- Unit 42: Pass the Passkey: A Novel Attack Surface in Passwordless Authentication
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
