Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on.
Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed, abused a cloud-synced passkey system from malware already on the victim's machine, and used a Windows Hello for Business key from a compromised user session without a fresh PIN or biometric check. None cracked the math.
The impact is not the same in all three cases.
- SpecterOps showed a Windows and Microsoft Entra ID chain that could impersonate privileged users while satisfying phishing-resistant multifactor authentication (MFA); that chain reused signed authentication material rather than stealing the authenticator's private key.
- Unit 42 showed attacks against Google Password Manager in Chrome, including a path that recovers the private keys for a victim's synced passkeys.
- Independent researcher Dirk-jan Mollema showed that malware already running in a signed-in Windows session can use a hardware-bound Windows Hello for Business key without asking the user to unlock it again.
The fixes and mitigations differ too. Microsoft's Windows logging vulnerability, CVE-2026-34348, has a vendor CVSS score of 6.5 and a Microsoft security update. Microsoft told The Hacker News that it has also applied mitigations for the reported issue involving passkey relay assertions.
Microsoft's Entra migration guidance, last updated August 3, 2026, continues to describe passkeys as resistant to replay attacks. The public Microsoft advisory tied to CVE-2026-34348 covers the Windows Event Logging Service issue, while the company's response did not provide technical details about the scope of the separate Entra-side mitigations.
"We appreciate the work of SpecterOps for reporting this through a coordinated vulnerability disclosure. We have applied mitigations for the reported issue involving passkey relay assertions and continue investing in security enhancements across authentication methods. We recommend adopting a least-privilege access approach, using phishing-resistant authentication methods, and maintaining endpoint protections by embracing a Zero Trust security model to be better protected," a Microsoft spokesperson told The Hacker News.
The Unit 42 and Mollema findings also show why no single choice between synced and device-bound passkeys closes the broader attack surface.
The Hacker News has also reached out to SpecterOps for further detail on its latest testing and will update this story with any response.
The login Windows kept
SpecterOps principal security researcher Michael Grafnetter presented the firm's Pass-the-Passkey research at Black Hat USA 2026 on August 5.
SpecterOps says Windows stored past YubiKey signatures in cleartext where authenticated unprivileged users, including remote users, could read them. The firm says chaining those signatures with weaknesses in Microsoft Entra ID's passkey validation allowed privileged-user impersonation despite policies requiring phishing-resistant MFA.
The Windows issue is tracked as CVE-2026-34348, an information-disclosure vulnerability in the Windows Event Logging Service. Microsoft's affected-product data covers releases across Windows 10, Windows 11 and Windows Server. The CVE's product scope does not establish that SpecterOps' full passkey chain works identically on every listed Windows release.
In this chain, the attacker does not need to extract the private key from a YubiKey or other authenticator. The dangerous material is an already generated signature that Windows retained and that SpecterOps says Entra ID accepted in the replay chain. That is a narrower failure than breaking FIDO2, but it can still produce the result defenders care about: an attacker authenticating as someone else.
The master key behind Google's synced passkeys
Unit 42's Pass-ta-key research targets Google Password Manager's synced-passkey system in Chrome on Windows. All three attacks described by the team start with malware already running on the victim's endpoint, without requiring an administrator-level privilege escalation.
The first path abuses Chrome's device identity machinery to obtain the signatures needed to act like a legitimate Google Password Manager client without a new device unlock or user interaction. Unit 42 demonstrated the technique against eBay even though the site requested user verification; after the researchers reported the problem, eBay changed its validation of the WebAuthn user-verification flag.
The most damaging variant, Golden Pass-ta-key, targets the Security Domain Secret, a 32-byte master key used to protect synced passkeys. Unit 42 first found the secret exposed in Chrome's device logging. Google removed it from that logging output after the report, but the researchers say the secret is still temporarily present in Chrome's process memory during re-registration. With the secret, an attacker can recover the victim's synced passkey private keys.
Unit 42 says Google's current implementation provides no way to rotate or revoke the Security Domain Secret. That makes the compromise more persistent than a single captured login.
Borrowing Windows Hello without the PIN
Mollema's research focuses on Windows Hello for Business. On most modern Windows devices, its backing key is protected by the Trusted Platform Module and cannot simply be exported. Software in the victim's session can still use that non-exportable key.
Mollema found that a low-privilege process in an already compromised user session can call Windows cryptographic interfaces to use the Windows Hello for Business key without producing a new PIN or biometric prompt. He then used the key as a FIDO2 credential against Microsoft Entra ID.
In that flow, Mollema found that the Entra WebAuthn challenge is valid for five minutes and is not bound to a session, user or tenant. A challenge requested on an attacker's system can therefore be taken to the victim's machine, signed there with the Windows Hello key and returned as a WebAuthn assertion. The resulting sign-in can satisfy Conditional Access rules requiring phishing-resistant authentication.
Mollema also found that the resulting token can lack a device ID claim, opening a route through device registration to a Primary Refresh Token and additional persistence.
The public material does not establish whether the Entra behaviors described by SpecterOps and Mollema stem from the same underlying Entra validation issue or from different checks that happen to produce similar authentication outcomes.
The overlap is real enough to compare; treating it as one bug would go beyond what the sources establish.
Strong cryptography, weaker surroundings
The three findings should not be collapsed into one replay bug.
SpecterOps demonstrated the danger of reusable signed assertions exposed by Windows and accepted through a cloud authentication path. Unit 42 showed malware manipulating client trust, user-verification handling, recovery and synced-key protection. Mollema showed software inside a live Windows session using a legitimate hardware-bound key to create fresh authentication material.
Those surrounding controls can still leave attackers with reusable assertions, synced passkey private keys, or a way to generate fresh authentication from a compromised Windows session.
Unit 42's attacks begin with malware already on the endpoint, while Mollema's begins inside an already compromised user session. Those two research tracks therefore show what passkeys may fail to contain after endpoint compromise, not a way to defeat them from an unauthenticated remote position.
For Windows, the immediate action is to install Microsoft's applicable security updates for CVE-2026-34348. Services accepting WebAuthn assertions should enforce the user-verification requirements they request. Endpoint defenses need to treat passkey stores, recovery flows and browser memory as credential-sensitive territory.
Entra defenders can also monitor unusual Windows Hello for Business authentications without a device identifier and unexpected device registrations. Neither synced passkeys nor device-bound passkeys fix implementation mistakes elsewhere in the chain.
Microsoft is increasing the stakes for getting those implementation details right. Starting September 1, 2026, Entra ID users currently enabled for SMS or voice authentication will be automatically enabled for passkeys and nudged to register them. Microsoft-provided SMS and voice delivery is scheduled to retire on February 1, 2027.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
English (US) ·