A PoisonSeed phishing campaign is bypassing FIDO2 security key protections by abusing the cross-device sign-in feature in WebAuthn to trick users into approving login authentication requests from fake company portals. In the recent phishing attack observed by Expel, the PoisonSeed threat actors do not exploit a flaw in FIDO2's security but rather abuse the legitimate cross-device authentication feature. This attack highlights how threat actors are finding ways to bypass phishing-resistant authentication by tricking users into completing login flows that bypass the need for physical interaction with a security key. This method effectively bypasses FIDO2 security key protections by allowing attackers to initiate a login flow that relies on cross-device authentication instead of the user's physical FIDO2 key. However, the phishing backend instead tells the legitimate login portal to authenticate using cross-device authentication. Expel warns that this attack does not exploit a flaw in the FIDO2 implementation, but instead abuses a legitimate feature that downgrades the FIDO key authentication process. Cross-device authentication is a WebAuthn feature that allows users to sign in on one device using a security key or authentication app on another device. The user targeted in the attack normally would use their FIDO2 security keys to verify multi-factor authentication requests. When the user scans this QR code using their smartphone or authentication app, it approves the login attempt initiated by the attacker.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Sat, 19 Jul 2025 17:45:16 +0000