Three distinct research efforts last week exposed various techniques to circumvent passkey protections, all without cracking the sophisticated cryptography they rely on. Instead, these attacks exploited different facets of system implementation, ranging from exposed authentication material to malware-abused cloud-synced systems and compromised user sessions. ### The Attacks Unveiled The impact and methodologies of these findings vary: * **SpecterOps** demonstrated a **Windows** and **Microsoft Entra ID** (formerly Azure Active Directory) chain capable of impersonating privileged users, even when phishing-resistant Multi-Factor Authentication (MFA) was enforced. This attack reused signed authentication material that **Windows** had inadvertently exposed, rather than compromising the authenticator's private key. * **Unit 42** revealed attacks against **Google Password Manager** in **Chrome**, including a method to recover private keys for a victim's synced passkeys via malware already present on the machine. * Independent researcher **Dirk-jan Mollema** showed that malware operating within an already signed-in **Windows** session could utilize a hardware-bound **Windows Hello for Business** key without requiring a fresh PIN or biometric verification from the user. ### Vendor Responses and Mitigations **Microsoft** has acknowledged **SpecterOps'** findings. The **Windows** logging vulnerability, tracked as **CVE-2026-34348**, carries a CVSS score of 6.5 and has received a security update. **Microsoft** has also applied mitigations for the reported issue involving passkey relay assertions within **Microsoft Entra ID**. Despite these mitigations, **Microsoft's** **Entra** migration guidance, last updated August 3, 2026, continues to describe passkeys as resistant to replay attacks. A **Microsoft** spokesperson emphasized the importance of a least-privilege access approach, phishing-resistant authentication methods, and endpoint protections under a **Zero Trust** security model. ### SpecterOps: The Login Windows Kept **SpecterOps** principal security researcher **Michael Grafnetter** presented the firm's "Pass-the-Passkey" research at Black Hat USA 2026. Their findings indicated that **Windows** stored past **YubiKey** signatures in cleartext, accessible to authenticated unprivileged users, including remote ones. By chaining these signatures with weaknesses in **Microsoft Entra ID's** passkey validation, privileged-user impersonation became possible, bypassing phishing-resistant MFA policies.  The **Windows** issue, **CVE-2026-34348**, is an information-disclosure vulnerability within the **Windows Event Logging Service**, affecting **Windows 10**, **Windows 11**, and **Windows Server**. Crucially, the attack does not require extracting the private key from an authenticator; the danger lies in the reusable, retained signatures that **Entra ID** accepted. ### Unit 42: The Master Key Behind Google's Synced Passkeys **Unit 42's** "Pass-ta-key" research targeted **Google Password Manager's** synced-passkey system in **Chrome** on **Windows**. All three attacks described by the team began with malware already running on the victim's endpoint, without requiring administrative privilege escalation. One path exploited **Chrome's** device identity mechanisms to obtain signatures, allowing an attacker to impersonate a legitimate **Google Password Manager** client without user interaction. This was demonstrated against **eBay**, which subsequently updated its validation of the **WebAuthn** user-verification flag.  The most severe variant, "Golden Pass-ta-key," targeted the **Security Domain Secret**, a 32-byte master key protecting synced passkeys. Initially found exposed in **Chrome's** device logging (since removed by **Google**), this secret remains temporarily present in **Chrome's** process memory during re-registration. Possession of this secret allows an attacker to recover the victim's synced passkey private keys. **Unit 42** noted that **Google's** current implementation offers no way to rotate or revoke this **Security Domain Secret**, leading to persistent compromise. ### Dirk-jan Mollema: Borrowing Windows Hello Without the PIN **Mollema's** research focused on **Windows Hello for Business**. While its backing key is typically protected by the **Trusted Platform Module (TPM)** and cannot be exported, software running in the victim's session can still utilize this non-exportable key. **Mollema** discovered that a low-privilege process within a compromised user session could invoke **Windows** cryptographic interfaces to use the **Windows Hello for Business** key without triggering a new PIN or biometric prompt. He then used this key as a **FIDO2** credential against **Microsoft Entra ID**. In this scenario, the **Entra WebAuthn** challenge was found to be valid for five minutes and was not bound to a specific session, user, or tenant. This allowed a challenge requested on an attacker's system to be signed on the victim's machine with the **Windows Hello** key and returned as a **WebAuthn** assertion. The resulting sign-in could satisfy Conditional Access rules requiring phishing-resistant authentication. **Mollema** also found that the resulting token could lack a device ID claim, potentially enabling device registration and the acquisition of a **Primary Refresh Token (PRT)** for additional persistence. ### Strong Cryptography, Weaker Surroundings The collective findings from **SpecterOps**, **Unit 42**, and **Dirk-jan Mollema** underscore a critical lesson: while passkeys leverage robust cryptographic principles, their security ultimately depends on the integrity of their surrounding implementation and ecosystem. These attacks highlight that the battle for secure authentication extends beyond the cryptographic core, demanding meticulous attention to system design, credential management, and endpoint security to truly achieve phishing resistance.