Passkeys Aren't Bulletproof: Three New Attacks Sidestep the 'Phishing-Proof' Login
Researchers show how signed login material, malware on synced devices, and clever redirection can defeat passkeys without cracking a single key.
Key points
- Three separate research teams disclosed passkey bypass techniques in the same week, none of which break the underlying cryptography.
- One attack reuses signed authentication material that Windows exposes during a normal login.
- Another abuses cloud-synced passkeys by running malware on a device the victim already trusts.
- A third redirects the login flow so the passkey check never happens as the user expects.
- Passkeys still beat passwords, but the marketing line that they are unphishable is now shakier.
Passkeys were sold as the end of the password era. Sign in with your face or fingerprint, the private key never leaves your device, and phishing sites, fake login pages built to steal your credentials, cannot trick you. That is the pitch.
Last week three research teams poked holes in it. None of them broke the maths. They went around it.
The work was rounded up by The Hacker News and covers three distinct techniques, each aimed at a different weak point in how passkeys are actually deployed.
What did the researchers actually do?
They found three ways to log in as someone else without ever stealing their private key. One attack picks up signed login tokens that Windows generates during normal use and replays them. A second uses malware sitting on a victim's laptop to abuse a passkey that syncs across their devices through the cloud. The third manipulates the browser flow so the passkey prompt is dodged or downgraded to a weaker option.
In plain terms: the cryptography held, but the plumbing around it leaked.
How do the three attacks compare?
| Attack | What it targets | What the attacker needs |
|---|---|---|
| Signed material reuse | Windows authentication output | Access to the victim's session |
| Synced passkey abuse | Cloud-synced passkey vaults | Malware on a trusted device |
| Flow redirection | The login handshake in the browser | A malicious page or extension |
Each one assumes the attacker has already got a foothold or can steer the victim's browser. That is a real bar, but it is not a high one for anyone who has watched infostealer malware spread over the past two years.
Are passkeys still worth using?
Yes. Passkeys remain a big upgrade over reusable passwords, and they still shut down the classic phishing page that harvests typed credentials. The new research does not change that.
What it does change is the marketing. Calling passkeys "phishing-resistant multi-factor authentication", the login method meant to prove it is really you and not a scammer, is fair. Calling them unphishable was always a stretch, and the past week made that clear.
The synced-passkey attack is the one worth watching. If a private key is copied between your phone, laptop and tablet through a cloud service, then any one of those devices becomes a target. Malware on the laptop can, in some setups, borrow the passkey the phone created.
What should ordinary users do?
Keep using passkeys. They are still safer than a password you reuse across ten sites.
A few practical steps:
- Prefer device-bound passkeys (stored only on one phone or hardware key) for your most sensitive accounts: email, banking, work identity.
- Keep the devices holding your synced passkeys clean. Do not install cracked software or browser extensions you have not vetted.
- Turn on login alerts where your provider offers them, so a strange sign-in shows up in your inbox quickly.
- If your workplace uses passkeys, ask whether the setup allows fallback to a weaker method like SMS codes. That fallback is often where attackers aim.
Regulators have not weighed in on these specific techniques yet. Expect the FIDO Alliance, the industry body that writes the passkey standard, to address the synced-key concerns in guidance rather than in the protocol itself. The fixes here look like implementation work for Microsoft, Apple, Google and password managers, not a rewrite of the standard.
The headline lesson is old and boring. A login system is only as strong as the device it runs on.
