AI and Tech Summaries - AI Weekly Malaysia

Summaries

Short AI and tech summaries with source links, signal scores, and why each update matters for builders, founders, and Malaysian tech workers.

Window

Today Yesterday This week Last week This month Last month All time

Showing 1-1 of 1 results

Date	Provider	Score	Summary
10 Aug 2026, 8:25 PM	The Hacker News	6.5	New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA Three separate research efforts last week demonstrated attacks that defeat passkey protections without breaking the underlying cryptography. SpecterOps showed a Windows + Microsoft Entra ID chain that impersonates privileged users while satisfying phishing-resistant MFA (CVE-2026-34348, CVSS 6.5, patched); Unit 42 demonstrated recovering private keys for cloud-synced passkeys via Google Password Manager in Chrome; and independent researcher Dirk-jan Mollema showed malware in an active Windows session can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric prompt. Why: If you ship passkey-based auth or rely on Windows Hello for Business / Entra ID for privileged access, these attacks mean endpoint compromise can undermine your MFA posture even with 'phishing-resistant' credentials. Review whether your architecture assumes a synced passkey store or an active Windows session is trustworthy—it may not be. Microsoft's own Entra migration guidance still describes passkeys as replay-resistant as of August 3, 2026, despite the SpecterOps relay finding, so don't treat vendor docs as a complete threat model. security passkeys authentication mfa windows entra-id

Date

Provider

Score

Summary

10 Aug 2026, 8:25 PM

The Hacker News

6.5

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Three separate research efforts last week demonstrated attacks that defeat passkey protections without breaking the underlying cryptography. SpecterOps showed a Windows + Microsoft Entra ID chain that impersonates privileged users while satisfying phishing-resistant MFA (CVE-2026-34348, CVSS 6.5, patched); Unit 42 demonstrated recovering private keys for cloud-synced passkeys via Google Password Manager in Chrome; and independent researcher Dirk-jan Mollema showed malware in an active Windows session can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric prompt.

Why: If you ship passkey-based auth or rely on Windows Hello for Business / Entra ID for privileged access, these attacks mean endpoint compromise can undermine your MFA posture even with 'phishing-resistant' credentials. Review whether your architecture assumes a synced passkey store or an active Windows session is trustworthy—it may not be. Microsoft's own Entra migration guidance still describes passkeys as replay-resistant as of August 3, 2026, despite the SpecterOps relay finding, so don't treat vendor docs as a complete threat model.