AI Weekly Malaysia

Three separate research efforts last week demonstrated attacks that defeat passkey protections without breaking the underlying cryptography. SpecterOps showed a Windows + Microsoft Entra ID chain that impersonates privileged users while satisfying phishing-resistant MFA (CVE-2026-34348, CVSS 6.5, patched); Unit 42 demonstrated recovering private keys for cloud-synced passkeys via Google Password Manager in Chrome; and independent researcher Dirk-jan Mollema showed malware in an active Windows session can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric prompt.

Why: If you ship passkey-based auth or rely on Windows Hello for Business / Entra ID for privileged access, these attacks mean endpoint compromise can undermine your MFA posture even with 'phishing-resistant' credentials. Review whether your architecture assumes a synced passkey store or an active Windows session is trustworthy—it may not be. Microsoft's own Entra migration guidance still describes passkeys as replay-resistant as of August 3, 2026, despite the SpecterOps relay finding, so don't treat vendor docs as a complete threat model.

France's tax authority (DGFiP) confirmed an intruder extracted taxpayer data in June 2026 after a cybercriminal using the alias 'ZeroBytes' advertised a database of 2 million French taxpayers on a cybercrime forum, claiming access via stolen credentials and an MFA bypass. DGFiP disputes the attacker's claim of continued access, says the breach was severed at end of June during an audit, and is investigating the exact scope while notifying CNIL and affected users.

Why: The breach vector—stolen credentials plus an MFA bypass—is a reminder that MFA alone is not sufficient if session tokens or bypass techniques are in play. Builders handling authentication should review whether their systems are vulnerable to token theft or MFA fatigue/bypass, but this incident has no direct operational impact on Malaysian builders.

The article text was not properly extracted—only cookie consent and privacy policy boilerplate from Ars Technica is present. The title and URL suggest it covers a newly disclosed 'Pass-ta-key' attack against passkeys that the author characterizes as 'mostly a nothingburger,' but no technical details, findings, or recommendations are available in the provided text.

Why: Cannot assess practical impact because the article body is missing. Do not rely on this item for any decision until the full text is available.