39 New Attack Methods Target Passkey Authentication Infrastructure

Passkeys were introduced as a phishing-resistant replacement for passwords, using public-key cryptography to bind credentials to legitimate services. While the cryptographic foundation remains strong, a growing body of research demonstrates that attackers are shifting focus to the surrounding infrastructure — including browsers, operating systems, password managers, cloud sync services, Bluetooth transports, account recovery systems, and the authentication user interface itself.

Published attack techniques now include assertion mining, assertion replay, circuit breaker attacks, assertion phishing, browser hooking, challenge injection, and user verification manipulation, among others. Researchers at SpecterOps demonstrated the "Pass the Passkey" approach, where malware running on a Windows machine can ask the legitimate WebAuthn infrastructure to generate a signed assertion. The user sees a normal authentication prompt and completes verification, while the attacker captures the resulting assertion. The private key never leaves its protected location, yet the account can still be compromised.

Several attacks also target the authentication interface. Researchers have documented passkey prompt flooding, credential interface deception, application metadata spoofing, window handle spoofing, remote desktop passkey phishing, and FIDO interface overlay attacks. These exploit the user experience layer to trick users into approving authentication they did not intend.

The findings suggest that enterprises relying solely on passkeys may need to broaden their threat models. The article, sponsored by hardware security key vendor Token, argues that dedicated biometric hardware is necessary to address these risks — a position that aligns with the vendor's product focus.

While not all 39 techniques have been operationalized by criminals, the research community is publishing the playbook openly, lowering the barrier for attackers to incorporate these methods into their toolkits.

Why This Matters

Organizations that have adopted passkeys as a password replacement may have a false sense of security if they have not considered attacks on the authentication infrastructure.
The public documentation of attack methods accelerates the threat landscape — attackers no longer need to invent techniques from scratch.
Enterprises must reassess identity assurance models, potentially adding hardware-backed or biometric verification to mitigate infrastructure-layer attacks.

Background

Passkeys, based on the FIDO2/WebAuthn standard, were designed to eliminate password-based phishing and credential theft. By keeping private keys on the user's device and never sharing them with servers, they raised the bar for many traditional attack vectors. However, as adoption grows, researchers are probing the complex trust boundaries involved in a passkey ceremony — from the browser to the operating system to cloud sync services — and finding vulnerabilities that don't require breaking the cryptography.

Key Perspectives

Security Researchers (SpecterOps & others): The attacks demonstrate that even if the cryptographic layer is secure, the authentication process can be manipulated through adjacent systems — malware, UI deception, and protocol quirks. Research like "Pass the Passkey" shows practical exploitation paths. Vendors (Token & hardware key proponents): These findings reinforce the need for dedicated biometric hardware that tightly controls authentication ceremonies, reducing the attack surface created by software-based passkey storage and cloud sync. Enterprise CISOs & Standards Bodies: The research suggests that FIDO2 deployments may require additional hardening — such as device attestation, strict user verification policies, and monitoring for known attack patterns — rather than treating passkeys as a complete solution.

What to Watch

Whether attackers begin operationalizing these techniques in credential theft campaigns, particularly against enterprises using software-only passkey implementations.
Updates from the FIDO Alliance on potential changes to the standard to close infrastructure-layer attack vectors.
Adoption of dedicated hardware passkeys by organizations as a response to the documented vulnerabilities.
Emergence of detection tooling for assertion capture and replay attacks within enterprise environments.

ZOTPAPER