Passkeys were introduced with a strong security proposition. Replace passwords with public key cryptography, bind the credential to the legitimate service, keep the private key away from the server, and many of the credential theft attacks that have plagued enterprise security for decades become dramatically harder. According to BleepingComputer, there are now at least 39 publicly documented methods, attack paths, research techniques, and exploitation scenarios involving passkeys and the surrounding infrastructure.
Understanding the Passkey Threat Model
Security professionals must recognize that the cryptography inside FIDO2 can remain completely intact while the account protected by the passkey is still compromised. A modern passkey authentication ceremony crosses an extraordinary number of trust boundaries. It can involve the web application, browser, operating system, password manager, cloud synchronization service, mobile device, Bluetooth transport, account recovery system, enrollment process, help desk, and ultimately the human being approving the authentication.
Published techniques include assertion mining, assertion replay, circuit breaker attacks, assertion phishing, browser hooking, assertion capture, challenge injection, detour replay, user verification manipulation, and user presence manipulation. SpecterOps demonstrated the significance of this problem in its research. One of its most important observations was that malware does not necessarily need to extract a private key. A malicious application can ask the legitimate WebAuthn infrastructure to generate a signed assertion. The user sees what appears to be a legitimate authentication experience, completes verification, and the adversary receives the resulting assertion. The private key never leaves its protected location. The cryptography was not cracked. Yet the authentication process was successfully manipulated.
User Interface and Ecosystem Vulnerabilities
Several of the published techniques target the user interface surrounding authentication. Researchers have demonstrated passkey prompt flooding, credential interface deception, application metadata spoofing, window handle spoofing, remote desktop passkey phishing, and FIDO interface overlay attacks. This recreates a problem the security industry already encountered with push-based multi-factor authentication. Users become accustomed to authentication prompts, allowing attackers to manufacture, repeat, disguise, or strategically time those interactions.
The attack surface grows significantly when passkeys can be shared, synchronized, exported, restored, or moved between devices. The published inventory now includes synced vault compromise, Apple or Google account takeover, cloud recovery takeover, stolen or compromised phones, mobile malware, rooted mobile devices, hybrid authentication manipulation, export theft, credential exchange theft, malicious browser extensions, and attacks involving CTAP and Bluetooth communication.
Shadow Passkeys and Enrollment Abuse
Some of the most consequential attacks do not steal an existing passkey at all. They simply create another one. Published techniques include shadow passkeys, enrollment vishing, attacker phone enrollment, attacker-controlled passkey registration, help desk takeover, temporary credential abuse, SIM-based recovery, reverse vishing, and migration pretext attacks.
Consider what happens when an adversary gains enough control of an employee account to initiate legitimate passkey registration. Instead of extracting the existing credential, the attacker registers an entirely new credential on a device under their control. Nothing has been cracked, and nothing has necessarily been stolen from the existing authenticator. The legitimate service itself creates a perfectly valid credential for the malicious actor.
Actionable Recommendations for Defenders
To secure enterprise environments against these evolving tactics, security teams should implement targeted defensive measures:
- Enforce Dedicated Hardware: Require hardware-bound security keys that cannot be synchronized across cloud vaults or exported to other devices, minimizing the risk of cloud-based vault compromise.
- Harden Enrollment Workflows: Implement strict identity verification for passkey enrollment, recovery, and help desk interactions to prevent the creation of shadow credentials or unauthorized device registrations.
- Monitor Endpoint Activity: Deploy endpoint detection tooling to identify malicious UI overlays, prompt flooding, and unauthorized requests to local WebAuthn infrastructure.
Related: Mitigating Large-Scale Credential Attacks and Password Spraying, Threat Actors Prefer Repeatable Playbooks Over Novel Exploits