Passkey Attacks Bypass Windows, Google Protections Without Breaking Encryption

Three separate security research teams last week revealed methods to circumvent passkey safeguards without compromising the underlying cryptographic technology, according to findings published by The Hacker News. While passkeys were built to replace traditional passwords and block phishing attempts, the newly disclosed techniques instead exploited signed authentication data that Windows had left accessible, manipulated a cloud-synchronized passkey platform from malware already present on a victim's device, and leveraged a Windows Hello for Business credential from a hijacked user session without requiring a fresh PIN or biometric scan. The attacks demonstrate that surrounding implementation weaknesses can undermine passkey security even when the core mathematics remains intact.

SpecterOps disclosed a Windows and Microsoft Entra ID vulnerability chain that let attackers impersonate high-privilege users while meeting phishing-resistant multifactor authentication requirements by reusing signed authentication material rather than extracting an authenticator's private key. Unit 42 documented attacks against Google Password Manager in Chrome, including a method that retrieves the private keys for a victim's synchronized passkeys through what the team calls the Golden Pass-ta-key variant, which targets the Security Domain Secret—a 32-byte master key protecting synced passkeys that researchers initially found exposed in Chrome's device logging and say remains temporarily present in Chrome's process memory during re-registration. Independent researcher Dirk-jan Mollema demonstrated that malware operating within a logged-in Windows session can invoke a hardware-protected Windows Hello for Business key without prompting the user to unlock it again, then use the key as a FIDO2 credential against Microsoft Entra ID by taking a challenge requested on an attacker's system to the victim's machine for signing. Microsoft patched the Windows logging vulnerability, tracked as CVE-2026-34348 with a vendor CVSS score of 6.5, and told The Hacker News the company "has also applied mitigations for the reported issue involving passkey relay assertions," though SpecterOps reported to The Hacker News that it hasn't retested the Entra replay weakness since June and that as of August 10, Entra still uses JSON Web Tokens as WebAuthn challenges rather than pseudorandomly generated nonces and doesn't appear to bind WebAuthn challenges to session cookies.

"We appreciate the work of SpecterOps for reporting this through a coordinated vulnerability disclosure. We have applied mitigations for the reported issue involving passkey relay assertions and continue investing in security enhancements across authentication methods," a Microsoft spokesperson told The Hacker News, recommending organizations adopt a least-privilege access approach, use phishing-resistant authentication methods, and maintain endpoint protections by embracing a Zero Trust security model. SpecterOps says Windows stored past YubiKey signatures in cleartext where authenticated unprivileged users, including remote users, could read them, and that chaining those signatures with weaknesses in Microsoft Entra ID's passkey validation allowed privileged-user impersonation despite policies requiring phishing-resistant MFA. Unit 42 says Google's current implementation provides no way to rotate or revoke the Security Domain Secret, making the compromise more persistent than a single captured login, while the firm's first attack path abuses Chrome's device identity machinery to obtain the signatures needed to act like a legitimate Google Password Manager client without a new device unlock or user interaction.

The report explains that the three findings expose different layers of implementation risk surrounding passkey technology rather than a single replay flaw: SpecterOps demonstrated the danger of reusable signed assertions exposed by Windows and accepted through a cloud authentication path, Unit 42 showed malware manipulating client trust and synced-key protection, and Mollema showed software inside a live Windows session using a legitimate hardware-bound key to create fresh authentication material. Unit 42's attacks begin with malware already on the endpoint, while Mollema's starts inside an already compromised user session, meaning those two research tracks show what passkeys may fail to contain after endpoint compromise rather than a way to defeat them from an unauthenticated remote position. For Windows, the immediate action is to install Microsoft's applicable security updates for CVE-2026-34348, while services accepting WebAuthn assertions should enforce the user-verification requirements they request, and endpoint defenses need to treat passkey stores, recovery flows, and browser memory as credential-sensitive territory. Microsoft is raising the stakes for getting implementation details right by automatically enabling Entra ID users currently using SMS or voice authentication for passkeys and nudging them to register starting September 1, 2026, with Microsoft-provided SMS and voice delivery scheduled to retire on February 1, 2027. The timing couldn't be more delicate: organizations betting their authentication future on passkeys now face a narrower margin for error in every surrounding control, from logging hygiene to challenge design. Neither device-bound nor synced passkeys eliminate the broader attack surface when implementation details falter.