New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA
- ID
- 12670
- Status
- summarized
- Published
- 10 Aug 2026, 8:25 PM
- Fetched
- 10 Aug 2026, 9:18 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 6.5
- Created
- 10 Aug 2026, 9:23 PM
- Tags
- Audience
- developerssaas_founders
What happened
Three separate research efforts last week demonstrated attacks that defeat passkey protections without breaking the underlying cryptography. SpecterOps showed a Windows + Microsoft Entra ID chain that impersonates privileged users while satisfying phishing-resistant MFA (CVE-2026-34348, CVSS 6.5, patched); Unit 42 demonstrated recovering private keys for cloud-synced passkeys via Google Password Manager in Chrome; and independent researcher Dirk-jan Mollema showed malware in an active Windows session can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric prompt.
Why it matters
If you ship passkey-based auth or rely on Windows Hello for Business / Entra ID for privileged access, these attacks mean endpoint compromise can undermine your MFA posture even with 'phishing-resistant' credentials. Review whether your architecture assumes a synced passkey store or an active Windows session is trustworthy—it may not be. Microsoft's own Entra migration guidance still describes passkeys as replay-resistant as of August 3, 2026, despite the SpecterOps relay finding, so don't treat vendor docs as a complete threat model.
Discussion angle
For founders and devs building auth: do these attacks change the calculus on recommending passkeys to users, or is the real lesson that endpoint hygiene and least-privilege still matter more than which MFA method you pick?