Passkeys Aren't Bulletproof: Three New Attacks Sidestep the 'Phishing-Proof' Login
Researchers show how signed login material, malware on synced devices, and clever redirection can defeat passkeys without cracking a single key.
Key points
- Three separate research teams disclosed passkey bypass techniques in the same week, none of which break the underlying cryptography.
- One attack reuses signed authentication material that Windows exposes during a normal login.
- Another abuses cloud-synced passkeys by running malware on a device the victim already trusts.
- A third redirects the login flow so the passkey check never happens as the user expects.
- Passkeys still beat passwords, but the marketing line that they're unphishable is now shakier.
Passkeys were sold as the end of the password era. Sign in with your face or fingerprint, the private key never leaves your device, and phishing sites, fake login pages built to steal your credentials, can't trick you. That's the pitch.
Last week three research teams poked holes in it. None of them broke the maths. They went around it.
The work was rounded up by The Hacker News and covers three distinct techniques, each aimed at a different weak point in how passkeys are actually deployed. We've been tracking this fault line since July: our story on Microsoft's near-exploitable passkey bugs found problems in Windows 11 and the company's cloud login service just as Microsoft prepares to make passkeys the default for hundreds of millions of users.
What did the researchers actually do?
They found three ways to log in as someone else without ever stealing a private key. One attack picks up signed login tokens that Windows generates during normal use and replays them. A second uses malware on a victim's laptop to abuse a passkey that syncs across devices through the cloud. The third manipulates the browser flow so the passkey prompt is dodged or downgraded to a weaker option.
The cryptography held. The plumbing around it leaked.
How do the three attacks compare?
| Attack | What it targets | What the attacker needs |
|---|---|---|
| Signed material reuse | Windows authentication output | Access to the victim's session |
| Synced passkey abuse | Cloud-synced passkey vaults | Malware on a trusted device |
| Flow redirection | The login handshake in the browser | A malicious page or extension |
Each one assumes the attacker has already got a foothold or can steer the victim's browser. That's a real bar, but not a high one for anyone who's watched infostealer malware spread over the past two years.
Are passkeys still worth using?
Yes. Passkeys remain a big upgrade over reusable passwords and still shut down the classic phishing page that harvests typed credentials.
What the new research changes is the marketing. Calling passkeys "phishing-resistant multi-factor authentication", the login method meant to prove it's really you and not a scammer, is fair. Describing them as unphishable was always a stretch, and last week made that clear.
The synced-passkey attack is the one worth watching. If a private key is copied between your phone and laptop through a cloud service, any one of those devices becomes a target. Malware on the laptop can, in some setups, borrow the passkey the phone created.
What should ordinary users do?
Keep using passkeys. They're still safer than a password reused across ten sites.
A few practical steps:
- Prefer device-bound passkeys (stored only on one phone or hardware key) for your most sensitive accounts: email, banking, work identity.
- Keep devices holding synced passkeys clean. Don't install cracked software or browser extensions you haven't vetted.
- Turn on login alerts where your provider offers them.
- If your workplace uses passkeys, ask whether the setup allows fallback to SMS codes. That fallback is often where attackers aim.
Regulators haven't weighed in on these specific techniques yet. Expect the FIDO Alliance, the industry body that writes the passkey standard, to address synced-key concerns in guidance rather than in the protocol itself. The fixes look like implementation work for Microsoft, Apple and Google, not a rewrite of the standard.
A login system is only as strong as the device it runs on. That lesson predates passkeys by decades, and it hasn't changed.
