New Passkey Attacks Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Three independent research efforts presented at Black Hat USA 2026 and in subsequent disclosures have demonstrated practical attacks against passkey implementations, undermining the assumption that passkeys are inherently phishing-resistant. The attacks do not break the underlying cryptography but instead exploit weaknesses in how passkeys are stored, synced, and validated by surrounding systems.

SpecterOps’ Pass-the-Passkey research, presented by Michael Grafnetter, showed that Windows stores past YubiKey signatures in cleartext, allowing authenticated unprivileged users to read them. By chaining these signatures with weaknesses in Microsoft Entra ID’s passkey validation, attackers could impersonate privileged users even when phishing-resistant MFA is enforced. The Windows issue is tracked as CVE-2026-34348, an information-disclosure vulnerability in the Windows Event Logging Service, with a CVSS score of 6.5. Microsoft has released security updates and applied mitigations for the passkey relay assertion issue.

Unit 42’s Pass-ta-key research targeted Google Password Manager’s synced-passkey system in Chrome on Windows. The attacks, which require malware already running on the endpoint, include a path that recovers the Security Domain Secret, a 32-byte master key protecting synced passkeys. With this secret, attackers can recover the victim’s synced passkey private keys. Google removed the secret from device logging after the report, but it remains temporarily present in Chrome’s process memory during re-registration. Unit 42 notes that Google’s implementation provides no way to rotate or revoke the Security Domain Secret, making the compromise persistent.

Independent researcher Dirk-jan Mollema demonstrated that malware in a signed-in Windows session can use a hardware-bound Windows Hello for Business key without prompting for a PIN or biometric. The Entra WebAuthn challenge is valid for five minutes and not bound to a session, user, or tenant, allowing an attacker to relay the challenge to the victim’s machine and sign it. The resulting token can lack a device ID claim, potentially enabling further persistence via device registration.

These findings highlight that neither synced nor device-bound passkeys fully address implementation flaws. Immediate actions include applying Microsoft’s security updates for CVE-2026-34348, enforcing user-verification requirements, and monitoring for unusual Windows Hello for Business authentications. Microsoft is also phasing out SMS and voice authentication for Entra ID, automatically enabling passkeys for affected users starting September 1, 2026, with SMS/voice retirement scheduled for February 1, 2027.