-
Chicago: 312-554-7550
-
St. Louis : 314-432-1661
-
Metro East IL : 618-346-8324
-
Central IL : 217-528-0500
Passkeys Were Supposed to Stop Phishing. Attackers Found a Way Around Them Anyway.
Passkeys have been marketed for the past few years as the fix for phishing. No password to steal, no code to intercept, just a device, a fingerprint, and cryptography that can’t be guessed or reused.
That pitch is still mostly true.
Security researchers disclosed a new set of techniques in August 2026, referred to as “Pass-the-Passkey” attacks, that bypass passkey-based logins without ever breaking the underlying cryptography. The private keys stayed exactly where they were supposed to, locked inside hardware or a trusted device enclave. Attackers found a way around passkeys anyway, by exploiting the systems and software around them instead.
That distinction matters more than it sounds. It means the fix isn’t “stop using passkeys.” It means passkeys were never meant to be your only line of defense in the first place.
What Actually Happened
Researchers at multiple security firms independently disclosed more than twenty separate attack techniques affecting Windows, Microsoft Entra ID, Chrome, and password managers that sync passkeys across devices. None of them cracked the cryptography behind FIDO2 or WebAuthn, the technical standards passkeys are built on. Instead, they targeted the surrounding ecosystem: how authentication events get logged, how servers validate login responses, and how applications interact with passkey systems.
The most serious chain combined a Windows logging flaw with a validation gap on Microsoft’s side, allowing an attacker who had already compromised a device to potentially replay a captured login and impersonate a privileged user, all while technically satisfying phishing-resistant multi-factor authentication requirements. Microsoft addressed the logging component through a security update, and researchers have said the most severe version of this particular attack chain is now considered closed. Related techniques affecting Google Password Manager’s synced passkeys on Windows were disclosed separately and, as of this writing, remain an active area of vendor response.
The Part Business Owners Actually Need to Understand
None of these attacks worked against a clean, unaffected device from a random internet connection. Every documented technique required the attacker to already have some level of access, most often malware already running on the victim’s machine, before the passkey bypass came into play.
That’s not a reason to dismiss the risk. It’s a reason to see it clearly. Passkeys are still dramatically better than passwords at stopping remote, credential-based phishing. What this research shows is that passkeys don’t make endpoint security optional. If a device is already compromised, a sufficiently motivated attacker can potentially work around even a phishing-resistant login. The passkey did its job. The rest of the security stack still has to do its job too.
Passkeys vs. Passwords: What Actually Changed
| Factor | Passwords | Passkeys |
|---|---|---|
| Vulnerable to remote phishing | Yes; a stolen or reused password works from anywhere | Largely no; a passkey can’t be entered into a fake login page |
| Vulnerable to credential reuse across sites | Yes | No; each passkey is unique to its service |
| Vulnerable if the device itself is compromised | Yes | Yes, under specific documented conditions |
| Requires the underlying device to be secure | Helpful, but not strictly required | Effectively required |
| Overall risk versus passwords | Higher | Meaningfully lower, not zero |
What This Means for Your Business’s Security Stack
Don’t reverse course on passkeys. They remain a significant improvement over passwords for stopping the most common form of phishing: a fake login page harvesting credentials. Nothing in this research changes that.
Keep endpoint security as a first-class priority, not an afterthought. Since every documented attack required a compromised device first, endpoint detection and response remains the control that prevents the scenario these attacks depend on.
Apply vendor patches on a defined schedule. The most severe attack chain in this research was already closed by a routine Windows security update. Businesses running current, patched systems were protected before the research was even public.
Treat authentication as one layer, not the whole plan. Passkeys solve phishing. They don’t solve malware, insider risk, or a stolen laptop. Layered security, endpoint protection, monitoring, and least-privilege access, still matters even after passkeys are in place.
Ask your IT provider directly whether your environment has been reviewed against this research. If nobody can answer, that’s worth following up on.
Common Misunderstandings About This Research
“Passkeys got hacked.” Not quite. The cryptography behind passkeys held. The attacks exploited the software and logging systems around passkeys, not the passkeys themselves.
“This means passwords were actually fine all along.” No. Every technique disclosed required a level of device access that most remote password-phishing attacks never need. Passkeys still close off a much larger and more common attack path.
“We should wait to roll out passkeys until this is fully resolved.” The most severe chain has already been patched. Waiting mainly delays the phishing protection passkeys already provide, without meaningfully reducing your risk from this specific research.
“This only affects big companies.” The techniques target Windows, Chrome, and widely used identity platforms, the same tools most small and mid-sized businesses run every day.
Â
Not Sure If Your Security Goes Beyond the Login?
Passkeys and MFA can make it much harder for attackers to steal their way into an account, but they do not protect a compromised device or close every security gap.
Our free Cybersecurity & AI Risk Assessment reviews your current security setup, including endpoint protection, patching, account security, monitoring, and emerging AI-related risks, to help identify where your business may still be exposed.
Download Your Free AI Policy Template
Frequently Asked Questions
Yes. Passkeys remain significantly more resistant to phishing and credential theft than passwords. This research targeted the surrounding systems, not the core cryptographic protection passkeys provide.
No. Delaying a passkey rollout mainly leaves your business exposed to the much more common risk, password-based phishing, that passkeys were adopted to prevent in the first place.
Confirm your systems are current on security patches, keep endpoint detection and response in place, and ask your IT provider whether your environment has been reviewed against these specific techniques.
No. Traditional phishing tricks a user into giving up credentials remotely. These attacks required an already-compromised device, a materially different and more limited attack path.
Organizations using Windows devices with Chrome or Microsoft Entra ID for passkey-based authentication are the ones directly referenced in the disclosed research. Even there, the primary prerequisite, a compromised endpoint, is preventable with standard security controls.
Key Takeaway
- Passkey cryptography was not broken. The disclosed attacks targeted the logging and validation systems around passkeys, not the passkeys themselves.
- Every documented technique required a compromised device first, which reinforces rather than replaces the need for endpoint security.
- Microsoft has already patched the most severe version of the attack chain through a routine security update.
- Passkeys remain a meaningful improvement over passwords and should still be part of your authentication strategy.
- Authentication is one layer of a security program, not the entire program.