Three separate security research studies successfully uncovered vulnerabilities in passkey protection. These flaws allowed the bypass of passkeys without breaking their underlying cryptography.

The discovered methods involved reusing signed authentication material from Windows, exploiting a cloud-synced passkey system via malware, and using a Windows Hello for Business key from a compromised session without a PIN or biometric check. The impact of these attacks varied depending on the scenario.

Three Passkey Attack Methods

SpecterOps researchers demonstrated an attack chain on Windows and Microsoft Entra ID. This method allowed attackers to impersonate privileged users and bypass phishing-resistant multifactor authentication (MFA). They achieved this by reusing signed authentication material, eliminating the need to steal the authenticator’s private key.

Another research by Unit 42 focused on Google Password Manager in Chrome. They successfully recovered private keys for synced passkeys by using malware already present on the victim’s machine. The most severe attack variant, Golden Pass-ta-key, targeted the Security Domain Secret, a 32-byte master key used to protect synced passkeys. By obtaining this secret, an attacker could recover a victim’s synced passkey private keys.

Meanwhile, an independent researcher, Dirk-jan Mollema, revealed that malware in an active Windows session could exploit a Windows Hello for Business key. This attack allowed the malware to bypass the need for a PIN or biometric prompt. Mollema used this hardware-bound key as a FIDO2 credential against Microsoft Entra ID, successfully creating fresh authentication material.

Fixes and Mitigations

The different attack vectors require distinct fixes. Microsoft addressed the Windows logging vulnerability with a security update for CVE-2026-34348. This vulnerability, rated with a CVSS score of 6.5, affected Windows 10, Windows 11, and Windows Server. Microsoft also confirmed that mitigations were applied to the Entra-side issue.

For Google Password Manager, Google removed the Security Domain Secret from Chrome’s device logging after receiving Unit 42’s report. However, the researchers noted that the secret still temporarily appears in Chrome’s process memory during re-registration, indicating a persistent risk.

Users are advised to apply the latest security updates, especially the Windows patch for CVE-2026-34348. Moreover, organizations should adopt a least-privilege access approach, use phishing-resistant authentication methods, and embrace a Zero Trust security model.

Source: https://thehackernews.com/2026/08/new-passkey-attacks-can-recover-synced.html