New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Introduction

Passkeys were designed to replace passwords and resist phishing attacks. They use strong cryptography to keep your accounts safe. But recent research has shown that even passkeys have vulnerabilities.

Three separate security research teams have discovered ways to bypass passkey protections without breaking the underlying encryption. These attacks target Windows Hello, Google Password Manager, and YubiKeys.

Attack 1: Windows Pass-the-Passkey (CVE-2026-34348)

Security researchers at SpecterOps discovered a dangerous vulnerability in Windows and Microsoft Entra ID. The attack, called "Pass-the-Passkey," allows attackers to impersonate privileged users even when phishing-resistant MFA is required.

How it works:

• Windows stored past YubiKey signatures in cleartext where authenticated users could read them.
• Attackers can reuse these signatures with weaknesses in Microsoft Entra ID's passkey validation.
• This allows attackers to impersonate privileged users without ever extracting the private key from a YubiKey.
• The vulnerability is tracked as CVE-2026-34348 and affects Windows 10, Windows 11, and Windows Server.

Microsoft has released a security update to address this issue. Administrators should install the update immediately.

Attack 2: Google Password Manager Passkey Theft

Palo Alto Networks' Unit 42 researchers discovered serious vulnerabilities in Google Password Manager's synced-passkey system in Chrome on Windows.

Three attack paths were identified:

• Path 1: Abuses Chrome's device identity machinery to obtain signatures without user interaction. Researchers successfully used this against eBay, which requested user verification.
• Path 2 (Most Damaging): Targets the Security Domain Secret — a 32-byte master key used to protect synced passkeys. This secret was exposed in Chrome's device logging and remains temporarily present in process memory.
• Path 3: Leverages the secret to recover the victim's synced passkey private keys.

Google has removed the secret from logging output, but the underlying issue remains — the secret is still temporarily present in Chrome's memory during re-registration.

Attack 3: Windows Hello for Business Bypass

Independent researcher Dirk-jan Mollema demonstrated that malware already running on a signed-in Windows session can use Windows Hello for Business keys without user interaction.

How it works:

• Windows Hello for Business keys are stored in the Trusted Platform Module (TPM) and cannot be exported.
• However, malware in the victim's session can call Windows cryptographic interfaces to use the key.
• The attacker can request an Entra WebAuthn challenge (valid for five minutes) on their own system.
• The challenge is signed on the victim's machine using the Windows Hello key.
• The resulting WebAuthn assertion is sent back to the attacker, satisfying phishing-resistant MFA requirements.
• The token may lack a device ID claim, allowing attackers to register new devices and maintain persistent access.

This attack requires malware already running on the victim's machine, but it shows that even hardware-bound keys can be abused from within a compromised session.

Key Takeaways

These three attacks show different weaknesses in passkey systems:

• SpecterOps: Reusable signed assertions exposed by Windows and accepted by cloud services.
• Unit 42: Malware manipulating client trust, user-verification handling, and synced-key protection.
• Mollema: Software inside a live Windows session using a hardware-bound key to create fresh authentication material.

How to Protect Your Business

For Windows Systems:

• Install Microsoft's security updates for CVE-2026-34348 immediately.
• Monitor for unusual Windows Hello for Business authentications without a device identifier.
• Watch for unexpected device registrations in your Entra ID environment.

For Google Password Manager Users:

• Be aware that synced passkeys are vulnerable to malware on the endpoint.
• Consider using device-bound passkeys instead of synced passkeys for sensitive accounts.
• Implement endpoint protections to prevent malware from accessing passkey data.

General Recommendations:

• Adopt a Zero Trust security model — don't trust any authentication factor alone.
• Use least-privilege access — limit what users can do even if authenticated.
• Monitor authentication logs for unusual patterns like empty device IDs.
• Combine multiple security layers — endpoint protection, Conditional Access policies, and monitoring.
• Educate employees about phishing and malware risks that can lead to session compromise.

Microsoft is also taking action:

• Starting September 1, 2026, Entra ID users currently enabled for SMS/voice authentication will be automatically enabled for passkeys.
• Microsoft-provided SMS and voice authentication is scheduled to retire on February 1, 2027.

Final Thoughts

Passkeys represent a significant improvement over traditional passwords. They are resistant to phishing and provide strong cryptographic protection. However, the recent research shows that passkeys are not invincible.

Key points to remember:

• Passkeys can be bypassed through implementation flaws and surrounding system weaknesses.
• Synced passkeys are more vulnerable than device-bound passkeys.
• Endpoint compromise can expose even hardware-bound keys.
• Defense-in-depth is essential — no single security measure is enough.
• Regular monitoring and proactive security updates are critical.

If you need help securing your authentication systems or want to learn more about protecting your business from these threats, contact SystemLogicIT for a free security assessment.