Researchers unveiled three distinct attack vectors against passkeys, the password replacement technology designed to resist phishing and credential theft. None of the attacks target the underlying cryptography. Instead, they exploit implementation weaknesses in how passkeys are stored, synced, and authenticated across systems.
The first attack leverages authentication material Windows exposes during normal operation. Threat actors can reuse signed authentication tokens that the operating system generates, effectively bypassing the phishing-resistant properties passkeys promise without compromising the cryptographic keys themselves.
The second approach targets cloud-synced passkey systems. If malware already resides on a victim's device, it can intercept passkeys stored in the cloud synchronization layer before they encrypt or during vulnerable moments in the sync process. This attack assumes endpoint compromise but demonstrates that cloud-backed passkey systems introduce additional attack surface compared to device-bound implementations.
The third vector exploits gaps in phishing-resistant authentication workflows, though details remain limited in available reporting.
These findings arrive as enterprises accelerate passkey adoption following major platform support from Apple, Microsoft, and Google. Passkeys eliminate the need for memorized passwords and theoretically prevent credential harvesting through phishing sites, since the authentication key never leaves the user's device.
The attacks highlight a critical distinction. Passkeys remain cryptographically sound. The vulnerability lies in operational implementation, particularly around how authentication tokens are managed after generation and how synced passkey systems protect keys during transit or temporary states.
For organizations, the implications are clear. Passkey deployment requires careful attention to secure enclave implementation, endpoint security to prevent malware from intercepting keys, and secure design of any cloud synchronization mechanisms. Device-bound passkeys offer stronger security posture than cloud-synced variants, especially in high-risk environments.
Users should remain cautious about endpoint security even after adopting passkeys. Malware on compromised devices can