Researchers Document 39 Ways to Compromise Passkey Authentication
Passkeys promise stronger security by replacing passwords with public key cryptography, binding credentials to legitimate services, and keeping private keys off servers. That security proposition remains largely true, but the threat landscape has shifted rapidly. Researchers now document at least 39 publicly known attack methods, research techniques, and exploitation scenarios involving passkeys and the infrastructure around them, many with working proof-of-concept tools or published research demonstrating exactly how they work.
While criminals have not operationalized all 39 techniques, the playbook is being written in public, meaning attackers no longer need to invent these methods themselves. Some techniques are already appearing in real-world attack patterns. The research exposes a critical distinction for enterprises: the cryptography inside FIDO2 can remain completely intact while the account protected by the passkey is still compromised. In other words, strong cryptography alone does not guarantee account security.
A modern passkey authentication ceremony crosses many trust boundaries, including the web application, browser, operating system, password manager, cloud sync service, mobile device, Bluetooth transport, account recovery systems, enrollment processes, help desks, and the human approving the authentication. Published attack techniques now include assertion mining, assertion replay, browser hooking, challenge injection, and user verification manipulation. SpecterOps' "Pass the Passkey" research shows malware does not even need to extract a private key—a malicious Windows application can simply ask legitimate WebAuthn infrastructure to generate a signed assertion, presenting the user with what looks like an authentic Windows login experience while the attacker captures the result.