Passkeys, introduced as a robust replacement for passwords leveraging public key cryptography, are facing a rapidly evolving threat landscape, with at least 39 distinct attack methods now publicly documented. While the underlying FIDO2 cryptography remains sound, researchers emphasize that compromise often occurs at layers surrounding the passkey, rather than through cryptographic breaks. These methods span various components of the authentication process, including web applications, browsers, operating systems, password managers, cloud synchronization services, mobile devices, and even human interaction.
A significant finding is that attackers do not necessarily need to extract a private key. Research, notably from SpecterOps' "Pass the Passkey" project, demonstrates that malicious applications can prompt the legitimate WebAuthn infrastructure to generate a signed assertion. In such scenarios, a user might complete what appears to be a legitimate Windows authentication, providing the attacker with a valid assertion without the private key ever leaving its secure location. This highlights that while cryptography may remain intact, the authentication process itself can be manipulated.
Many of the identified techniques target the user interface surrounding authentication. These include passkey prompt flooding, credential interface deception, application metadata spoofing, and FIDO interface overlay attacks. This mirrors a challenge previously seen with push-based multi-factor authentication, where users become accustomed to authentication prompts, making them susceptible to manufactured, repeated, or disguised interactions. SpecterOps has shown tools capable of repeatedly invoking legitimate-looking Windows passkey prompts, and other research indicates methods to make malicious authentication activity appear to originate from trusted applications. This underscores that cryptographic phishing resistance does not guarantee deception resistance across the broader operating system, browser, application, and user interface layers.
The attack surface expands considerably when passkeys are designed to be shareable, synchronized, exported, restored, or moved between devices. Documented attack paths include synced vault compromise, Apple or Google account takeover, cloud recovery takeover, and theft via compromised phones, mobile malware, or rooted devices. Other vectors involve hybrid authentication manipulation, export theft from password managers like KeePassXC and Bitwarden, credential exchange theft, malicious browser extensions, and attacks targeting CTAP and Bluetooth communication. This points to an architectural vulnerability: once a credential can traverse multiple systems, its security boundary extends beyond the original authenticator, inheriting weaknesses from the managing phone, operating system, password manager, or cloud account.
Crucially, some of the most impactful attacks bypass existing passkeys entirely by creating new ones. These methods include shadow passkeys, enrollment vishing, attacker-controlled passkey registration, help desk takeover, and temporary credential abuse. An attacker gaining sufficient control over an employee account could initiate a legitimate passkey registration, creating a new, valid credential on a device they control. This highlights that robust phishing-resistant authentication is insufficient if the processes for enrollment, replacement, recovery, and device registration are not secured to the same high standard.
Dedicated biometric hardware offers a different security model by retaining private credentials within secure hardware, without cloud synchronization or export mechanisms. Such authenticators can require a live fingerprint directly on the device and physical proximity to the requesting endpoint. By not incorporating a general-purpose operating system, application store, browser, or screen, these devices eliminate large portions of the attack surface, reducing opportunities for malicious applications, browser extensions, or deceptive interfaces. This specialized design significantly alters the economics of attacking these authenticators compared to general-purpose computing environments.
