Report

Pass-the-Passkey Family of Attacks

Our SpecterOps research on passkey security uncovered three practically exploitable zero-day vulnerabilities in Windows 11 and Microsoft Entra ID, plus more than 20 attack techniques targeting the passkey ecosystem.

Key Takeaways

Windows 11 writes complete WebAuthn assertions to a Windows Event Log readable by unprivileged local and remote users, turning a “phishing-resistant” credential into a replayable secret. Note: This was patched by Microsoft in July 2026; it’s included here to illustrate the failure pattern, not as a current exposure.
Microsoft Entra ID historically failed to enforce core WebAuthn anti-replay protections (challenge reuse, session binding, signature counters), letting captured assertions impersonate privileged cloud identities.
Malware running locally doesn’t need to steal a private key at all — it can simply call the documented Windows WebAuthn API directly and phish the user with a nativelooking passkey prompt.

Estimated read time: 60 min

Download the Report

Executive Summary

WebAuthn’s resistance to phishing and replay comes from cryptographic properties passwords never had. Our research shows that when the surrounding implementation falls short, including Windows, Entra ID, and password managers, those guarantee quietly degrade. We call this category of attacks Pass-the-Passkey, because the failure modes mirror classic identity attacks like Pass-the-Hash and NTLM Relay.

*First Presented at Black Hat USA 2026

The Path Forward

Passkeys are still a major improvement over passwords, and we encourage organizations to adopt them. For high-value accounts, we recommend device-bound passkeys over synced ones, with attestation enforced so only genuine, approved authenticators are used.

The Red Teamer’s Guide to Passkeys

In this session, we’ll examine Pass-the-Passkey, a category of malware-initiated attack techniques targeting passkey authentication that can enable cloud user impersonation.

Pass-the-Passkey Family of Attacks

Executive Summary

The Path Forward

The Red Teamer’s Guide to Passkeys

Ghostwriter v7: Safer Tokens, Scoped Access, and Better Automation

Maturity Model

Trends in Identity Attack Path Management 2026

Pass-the-Passkey Family of Attacks

Executive Summary

The Path Forward

The Red Teamer’s Guide to Passkeys

You might also be interested in

Ghostwriter v7: Safer Tokens, Scoped Access, and Better Automation

Maturity Model

Trends in Identity Attack Path Management 2026