Researchers found attacks that can recover synced passkeys or abuse Windows authentication on compromised systems without breaking passkey cryptography.

Security researchers have demonstrated several attacks that can undermine passkey-based authentication without breaking the cryptography behind the technology.

The research, presented by Palo Alto Networks Unit 42, SpecterOps and independent researcher Dirk-jan Mollema, describes different ways attackers can abuse authentication material exposed by Windows, compromise Google Password Manager’s synced-passkey system, or use Windows Hello credentials from an already compromised session.

Passkeys are designed to replace reusable passwords and provide strong resistance against phishing. However, the researchers found that weaknesses in the systems surrounding passkeys can still provide attackers with ways to authenticate as legitimate users.

The three findings have different attack paths and impacts.

Unit 42’s research focuses on Google Password Manager in Chrome on Windows, where researchers identified three attack techniques collectively known as Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key.

All three attacks require malware to already be running on the victim’s Windows computer. They do not involve breaking the underlying cryptography of the passkeys.

The first technique abuses Chrome’s device identity mechanisms to obtain authentication material that can be used to act as a legitimate Google Password Manager client. Unit 42 demonstrated the technique against eBay, where the researchers were able to authenticate despite the site requesting user verification. eBay changed its validation after the issue was reported.

The most serious technique, known as Golden Pass-ta-key, targets the Security Domain Secret, a 32-byte master key used to protect synced passkeys.

Unit 42 found that the secret was exposed through Chrome’s device logging. Google removed it from that logging after the researchers reported the issue, but Unit 42 said the secret remains temporarily available in Chrome’s process memory during device re-registration.

If an attacker obtains the Security Domain Secret, they can recover the private keys associated with the victim’s synced passkeys.

Separately, SpecterOps demonstrated an attack chain involving Windows and Microsoft Entra ID.

SpecterOps found that Windows stored previously generated YubiKey signatures in cleartext through the Windows Event Logging Service. According to the researchers, authenticated unprivileged users, including remote users in some circumstances, could access the stored signatures.

The issue is tracked as CVE-2026-34348, an information-disclosure vulnerability affecting the Windows Event Logging Service.

SpecterOps demonstrated that the exposed signatures could be combined with weaknesses in Microsoft Entra ID’s passkey validation to impersonate privileged users while satisfying policies requiring phishing-resistant multifactor authentication.

The attack does not extract the private key from the YubiKey. Instead, it reuses an authentication signature that Windows had already generated and retained.

Microsoft has released security updates for CVE-2026-34348 and told The Hacker News that it has also applied mitigations for the reported issue involving passkey relay assertions.

Independent security researcher Dirk-jan Mollema demonstrated another technique involving Windows Hello for Business.

The research found that software operating inside an already compromised Windows user session can use the user’s Windows Hello for Business key through Windows cryptographic interfaces without requiring a new PIN or biometric prompt.

Mollema then used the hardware-bound key as a FIDO2 credential against Microsoft Entra ID.

The researcher found that an Entra WebAuthn challenge remains valid for five minutes and is not sufficiently bound to a particular session, user or tenant. This can allow an attacker to request a challenge from their own system, have it signed by the victim’s Windows Hello key, and then return the resulting WebAuthn assertion to the attacker’s system.

The resulting authentication can potentially satisfy Conditional Access policies requiring phishing-resistant authentication.

The findings do not demonstrate a break of FIDO2 or WebAuthn cryptography.

Instead, the researchers targeted different parts of the authentication process, including cloud synchronization, device identity, recovery mechanisms, operating-system logging, authentication validation and compromised endpoints.

That distinction is important. Passkeys can remain cryptographically secure while weaknesses in the software and authentication infrastructure surrounding them provide attackers with alternative ways to obtain authentication capability.

The Unit 42 attacks require malware to already be running on the Windows endpoint, while Mollema’s technique begins from an already compromised user session. These are therefore not attacks that allow an unauthenticated remote attacker to simply steal someone’s passkey.

The findings nevertheless demonstrate the importance of protecting the systems that manage and use passkeys. Endpoint compromise, insecure authentication validation and exposed authentication material can undermine some of the protections that passkeys are designed to provide.

Organizations should apply Microsoft’s security updates for CVE-2026-34348, ensure WebAuthn user-verification requirements are correctly validated, and continue protecting endpoints where passkeys and authentication credentials are handled.

For users, the research does not mean that passwords are safer than passkeys. Passkeys remain designed to prevent common attacks such as phishing and password reuse. Instead, the findings show that attackers are increasingly targeting the infrastructure surrounding passwordless authentication rather than trying to break the cryptography itself.

Source: Hacker News

Related articles :

__Reports are sourced from official documents, law-enforcement updates, and credible investigations.

Discover additional reports, market trends, crime analysis and Harm Reduction articles on DarkDotWeb to stay informed about the latest dark web operations.__

New Passkey Attacks Can Recover Synced Private Keys