New Research Shows Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing‑Resistant MFA
What Happened — Three independent research teams published proof‑of‑concept attacks that defeat passkey‑based authentication without breaking the underlying cryptography. The techniques reuse signed authentication material exposed by Windows, hijack a cloud‑synced passkey store via malware already on the endpoint, and exploit implementation quirks to bypass the phishing‑resistant properties of modern MFA.
Why It Matters for Compliance & Audit Readiness
- SOC 2 Access Controls (CC6.1, CC6.2) require that logical access mechanisms be “designed to prevent unauthorized access” – these attacks demonstrate a gap in current passkey implementations.
- Continuous‑compliance programs must evidence that MFA and credential‑management policies are regularly reviewed against emerging threats; the new vectors provide a concrete audit trigger.
- Security Awareness Training must be updated to cover passkey‑specific phishing and malware scenarios, satisfying the “Security Awareness” control (CC7.1).
Who Is Affected – Organizations that have deployed passkeys for employee or customer authentication, especially in technology SaaS, financial services, and healthcare sectors where MFA is a SOC 2 requirement.
Recommended Actions
- Review your MFA and passkey policies; add controls that detect and block reuse of signed authentication material and protect synced credential stores.
- Incorporate the described attack scenarios into your security‑awareness curriculum and conduct tabletop exercises.
- Deploy endpoint‑monitoring rules that flag attempts to read Windows authentication artifacts or access cloud‑synced key stores.
Technical Notes
- Attack 1 leverages Windows‑exposed signed authentication blobs (no CVE, but a design‑level leakage).
- Attack 2 abuses a cloud‑synced passkey store via malware that extracts the private key after it has been synchronized.
- Attack 3 demonstrates a “passkey‑replay” that bypasses phishing‑resistant MFA by replaying previously captured authentication data.