Clarissa Hana
Passkeys emerged onto the cybersecurity scene with a promise of revolutionizing digital authentication. Designed to replace vulnerable passwords, they leverage public key cryptography, binding credentials to legitimate services while keeping private keys securely on user devices, thereby aiming to neutralize decades-old phishing and credential theft tactics. While the core cryptographic principles of passkeys remain robust, the security conversation has rapidly evolved, revealing a complex ecosystem of potential vulnerabilities. Researchers have now documented at least 39 distinct methods, attack paths, research techniques, and exploitation scenarios targeting passkeys and their surrounding infrastructure. Many of these have working proof-of-concept tools and published research, with some already appearing in real-world attack patterns. This proliferation of attack vectors does not suggest that all 39 methods are currently operationalized by adversaries, but it undeniably signifies that the playbook for compromising passkey-protected accounts is being developed and shared publicly, reducing the burden on attackers to innovate from scratch. Crucially, this research highlights a fundamental distinction: the underlying FIDO2 cryptography can remain unbreached while the account it is meant to protect is still compromised.
Beyond Cryptography: The Shifting Target of Passkey Attacks
The initial security proposition of passkeys centered on their cryptographic strength. However, the modern passkey authentication ceremony, often referred to as a "ceremony," traverses an intricate web of trust boundaries. This process can involve the web application, the user’s browser, the operating system, a password manager, cloud synchronization services, the mobile device, Bluetooth transport mechanisms, account recovery systems, the initial enrollment process, help desk personnel, and ultimately, the human user who approves the authentication. Researchers have been diligently probing nearly every one of these layers, developing sophisticated techniques such as assertion mining, assertion replay, circuit breaker attacks, assertion phishing, browser hooking, assertion capture, challenge injection, detour replay, user verification manipulation, and user presence manipulation.
A seminal demonstration of this expanding threat landscape came from SpecterOps’ "Pass the Passkey" research. One of their most significant findings was that malware does not necessarily need to extract the private key to compromise an account. Instead, a malicious Windows application can solicit the legitimate WebAuthn infrastructure to generate a signed assertion. The user, presented with what appears to be a standard Windows authentication dialogue, completes the verification process. Subsequently, the attacker receives the resulting assertion, having never directly accessed the private key. The cryptography remains intact, and the authentication process is successfully manipulated. This distinction is paramount to understanding the evolving passkey threat model.
The Illusion of Security: Cryptography Alone is Insufficient
The core of the passkey’s security promise lies in its cryptographic underpinnings. However, as the research indicates, this cryptographic integrity does not guarantee end-to-end security. A critical insight is that passkeys are not inherently impenetrable unless integrated with dedicated biometric hardware. Attackers are increasingly targeting the passkey enrollment process rather than attempting to break the cryptographic protocols themselves. This emphasizes why dedicated biometric hardware is crucial for strengthening enterprise identity assurance.
The Passkey Prompt: A New Frontier for Attackers
Even the user interface elements involved in passkey authentication have become a significant attack surface. Several of the 39 documented techniques specifically target the user interface surrounding the authentication process. Researchers have showcased methods like passkey prompt flooding, credential interface deception, application metadata spoofing, window handle spoofing, remote desktop passkey phishing, and FIDO interface overlay attacks. This situation mirrors a problem the cybersecurity industry has previously encountered with push-based multi-factor authentication (MFA). As users become accustomed to routine authentication prompts, these visual interactions can be manufactured, repeated, disguised, or strategically timed by attackers.
SpecterOps’ research, for instance, demonstrated tooling capable of repeatedly invoking legitimate-looking Windows passkey prompts. Furthermore, researchers have shown techniques that can make malicious authentication activity appear to originate from an application that an employee trusts. This underscores a vital lesson: phishing resistance at the cryptographic protocol layer does not automatically translate to deception resistance across the operating system, browser, application, and user interface layers that surround that protocol.
Shareability and Synchronization: Expanding the Attack Surface
The security perimeter of passkeys expands dramatically when credentials can be shared, synchronized, exported, restored, or moved between devices. The current inventory of documented attacks includes compromised synced vaults, account takeovers of Apple or Google accounts, cloud recovery system compromises, theft of or access to compromised phones, mobile malware infections, rooted mobile devices, manipulation of hybrid authentication systems, theft of exported credentials from password managers like KeePassXC and Bitwarden, credential exchange theft, malicious browser extensions, and attacks exploiting CTAP and Bluetooth communication.
This is not primarily a cryptographic deficiency but rather an architectural one. When a credential can traverse between devices, synchronize via a cloud account, be exported from a vault, restored through an alternative identity, or recovered via a separate process, the security boundary extends far beyond the original authenticator. In such scenarios, an attacker no longer needs to defeat FIDO2 directly; instead, they must compromise one sufficiently trusted component within the surrounding ecosystem. Consequently, a synchronized passkey, despite employing robust cryptography, can inherit the vulnerabilities of the phone, operating system, password manager, cloud account, browser, recovery process, and synchronization system responsible for its management.
Enrollment and Recovery: The Gateway for New Compromises
Some of the most impactful attacks do not involve stealing an existing passkey but rather creating a new one. Documented techniques include the creation of "shadow passkeys," enrollment via vishing (voice phishing), attacker-controlled phone enrollment, attacker-registered passkey registration, help desk takeover, abuse of temporary credentials, SIM-based recovery exploits, reverse vishing, and attacks leveraging migration pretexts.
Consider a scenario where an attacker gains sufficient control over an employee’s account to initiate legitimate passkey registration. Instead of exfiltrating the employee’s current credential, the attacker registers an entirely new credential on a device under their control. In this instance, no cryptography has been broken, and no existing authenticator has necessarily been compromised. The legitimate service itself generates a valid credential for the adversary. This highlights an increasingly critical identity principle: phishing-resistant authentication is insufficient if the processes for enrollment, replacement, recovery, and device registration are not protected to an equivalent security standard.
The Differentiated Security of Dedicated Biometric Hardware
Dedicated biometric hardware offers a fundamentally different approach to passkey security compared to credentials stored on general-purpose devices. A purpose-built biometric authenticator can securely retain the private credential within its hardware, eliminating cloud synchronization, export mechanisms, and reliance on password managers for credential transfer. Authentication typically requires a live fingerprint scan directly on the authenticator and physical proximity to the endpoint requesting access.
Crucially, a dedicated authenticator does not need to host a traditional general-purpose operating system, an application store, a browser, or a display screen. This distinction significantly reduces the attack surface. There are no third-party applications for attackers to replace with malicious versions, no avenues for rogue applications to be installed, no browser extension ecosystem to compromise, and no screen on which malware can present deceptive authentication interfaces. Moreover, the absence of a consumer operating system with its associated applications, permissions, background services, and update dependencies further fortifies its security. The authenticator is designed to perform a limited set of security-specific functions and nothing more.
This architectural design drastically alters the economic viability of attacking such devices. Instead of attempting to compromise a vast general-purpose computing environment, an attacker confronts a tightly controlled hardware device engineered specifically to safeguard cryptographic credentials and verify biometric identity. It also renders the authentication process far more resistant to employee manipulation. While an employee might be persuaded to visit a website, answer a phone call, or follow instructions from someone posing as technical support, social engineering tactics cannot install rogue applications onto hardware that does not run ordinary software, manipulate a non-existent screen, or synchronize a credential through a cloud service that the authenticator does not utilize. In essence, properly designed dedicated biometric hardware offers a dual layer of protection: high resistance to attackers and high resistance to errors made by employees.
Configuration of Relying Services: A Critical Component
However, dedicated hardware alone is not a panacea. The relying service – the website or application seeking authentication – must be configured to uphold the security model. For sensitive enterprise environments, authentication and enrollment processes should be restricted to approved authenticator classes. The relying party must validate authenticator identity, enforce user verification, properly authenticate challenges and sessions, utilize appropriate signature counter protections, and prevent weaker methods from serving as fallback authentication paths.
Enrollment and recovery processes warrant particular attention. The addition of a new authenticator should ideally require verification from an already authorized authenticator, rather than relying solely on proving account control through a less secure recovery channel. When configured correctly, this architecture prevents an attacker from simply enrolling an ordinary passkey from another laptop, phone, software vault, or security key. Compromise of a cloud account or password manager would not yield the credential, and mobile malware would be incapable of infecting the dedicated authenticator. Malicious applications cannot be installed on it, and a remote attacker cannot engineer the combination of dedicated hardware, biometric verification, physical proximity, and legitimate service interaction required for authentication.
The Broader Implications of the 39 Attack Vectors
The existence of 39 documented attack methods does not signify a failure of FIDO2 cryptography; in many respects, it demonstrates the opposite. Researchers are repeatedly targeting the software, synchronization systems, enrollment processes, operating systems, browsers, recovery mechanisms, and human elements surrounding the credential precisely because directly defeating properly implemented cryptographic hardware is considerably more challenging. This should serve as a critical signal to security leaders, indicating where the next vital identity boundaries need to be established.
For high-value enterprise identities, credentials should not be freely shareable across consumer devices and cloud ecosystems. Instead, they should be intrinsically bound to dedicated biometric hardware, the verified individual, the legitimate service, and an enterprise-controlled enrollment and recovery process. Passkeys have undoubtedly addressed a significant portion of the password problem. The 39 published attacks effectively reveal the vectors that adversaries are actively exploring. Dedicated biometric hardware, when implemented correctly from enrollment through authentication and recovery, effectively removes virtually all of the surrounding attack surface before an attacker even has an opportunity to exploit it, thereby offering a more robust and resilient solution for enterprise identity assurance.
To delve deeper into these published attack methods and understand how dedicated biometric hardware reshapes the enterprise identity trust model, download the Token passkey security ebook.
This article was sponsored and written by Token.
