Three passkey attacks land in one week, none of them breaking the cryptography
SpecterOps, Unit 42, and Dirk-jan Mollema each demonstrated ways to defeat passkey protections without attacking WebAuthn itself, through cleartext event logs, Chrome sync key recovery, and in-session key reuse.
Three separate research efforts published in early August 2026 defeated passkey protections without touching the underlying cryptography. SpecterOps found Windows wrote YubiKey WebAuthn assertions to event logs in cleartext readable by unprivileged users, replayable through Microsoft Entra ID to impersonate privileged accounts and satisfy phishing-resistant MFA rules (CVE-2026-34348, CVSS 6.5, mitigated in July 2026 Windows updates). Unit 42 recovered synced private keys from Chrome's Google Password Manager on Windows by pulling the 32-byte Security Domain Secret out of process memory. Dirk-jan Mollema showed low-privilege code in a signed-in session can drive a TPM-bound Windows Hello key with no fresh PIN or biometric prompt.
Why it matters
Every one of these attacks starts with malware already on the endpoint, which is the honest framing: passkeys removed the remote phishing problem and did not claim to solve local compromise. What they expose is the plumbing around the credential rather than the credential itself. Two structural issues recur. Entra ID uses JWTs as WebAuthn challenges instead of pseudorandom nonces and does not bind the challenge to a session, user, or tenant. And Google's Security Domain Secret, once recovered, has no rotation or revocation path, so a single compromise is permanent for that sync domain. Practical takeaways: prefer device-bound hardware keys for privileged accounts, treat endpoint compromise as full identity compromise, and hunt for sign-ins with empty device IDs. See also our note on Windows Hello key abuse.
Source: The Hacker News
Related on Start with Identity
- BlogPass-the-Passkey: a Black Hat researcher found the WebAuthn implementation bugs, not the standard
At Black Hat USA 2026, DSInternals researcher Michael Grafnetter presented a family of passkey attacks including cleartext YubiKey signatures readable by any au
- BlogUnit 42 finds malware can extract Google's synced passkey keys straight out of Chrome's memory
Palo Alto Networks Unit 42 disclosed three attacks, Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, that extract device identity keys and the master se
- BlogA CVSS 10.0 bug let one user's Terraform token serve another user's request
HashiCorp's Terraform MCP Server failed to assign unique session identifiers in stateless HTTP mode, so a token supplied by one user could be reused for later r
- GuideRemote IAM Jobs: How to Find and Land Them in 2026
Identity and access management is one of the more remote-friendly specialties in security. Most of the work is configuration, automation, policy, and design, no
- BreachMFA fatigue and push bombing: defeating MFA without breaking it
Push-based MFA can be defeated not by breaking the cryptography but by wearing the user down. Here is how MFA-fatigue attacks work and why number matching and p
- VendorOne Identity
strong_contender