New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Researchers have discovered methods to bypass passkey protections, which are intended to replace traditional passwords and provide resistance to phishing attacks. These methods do not involve breaking the underlying cryptography, but rather exploit other vulnerabilities. One approach reuses signed authentication material that has been exposed by Windows. Another method involves abusing a cloud-synced passkey system using malware that is already present on the victim's machine. A third technique was also identified, although details of this specific attack are not provided. These findings suggest that passkey protections may be vulnerable to certain types of attacks.