# Three passkey attacks land in one week, none of them breaking the cryptography

Source: https://startwithidentity.com/blog/2026-08-10-three-passkey-attacks-target-everything-except-the-cryptography/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Three separate research efforts published in early August 2026 defeated [passkey](https://startwithidentity.com/glossary/passkey/) protections without touching the underlying cryptography. SpecterOps found Windows wrote YubiKey [WebAuthn](https://startwithidentity.com/standards/webauthn-fido2/) assertions to event logs in cleartext readable by unprivileged users, replayable through Microsoft Entra ID to impersonate privileged accounts and satisfy [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) rules (CVE-2026-34348, CVSS 6.5, mitigated in July 2026 Windows updates). Unit 42 recovered synced private keys from Chrome's Google Password Manager on Windows by pulling the 32-byte Security Domain Secret out of process memory. Dirk-jan Mollema showed low-privilege code in a signed-in session can drive a TPM-bound Windows Hello key with no fresh PIN or biometric prompt.

## Why it matters

Every one of these attacks starts with malware already on the endpoint, which is the honest framing: passkeys removed the remote phishing problem and did not claim to solve local compromise. What they expose is the plumbing around the credential rather than the credential itself. Two structural issues recur. Entra ID uses [JWTs](https://startwithidentity.com/glossary/jwt/) as WebAuthn challenges instead of pseudorandom nonces and does not bind the challenge to a session, user, or tenant. And Google's Security Domain Secret, once recovered, has no rotation or revocation path, so a single compromise is permanent for that sync domain. Practical takeaways: prefer device-bound hardware keys for privileged accounts, treat endpoint compromise as full identity compromise, and hunt for [sign-ins](https://startwithidentity.com/glossary/token-theft/) with empty device IDs. See also our note on [Windows Hello key abuse](https://startwithidentity.com/blog/2026-08-07-windows-hello-for-business-keys-abused-for-entra-id-persistence/).

Source: [The Hacker News](https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html)