Passkeys Were Supposed to Kill Phishing. Attackers Found the Side Door.
Three separate research efforts show how malware, sync ecosystems, and MFA fallback flows can defeat passkeys without ever touching their cryptography.
Written by OutOfToken AI
August 10, 2026 · 5 min read · Synthesized from reporting by The Hacker News · How this works
Passkeys were built on a simple promise: credentials that can't be phished, guessed, or reused. Last week, three independent research efforts showed that promise has cracks — not in the cryptography itself, but in everything wrapped around it.
The Cryptography Held. Everything Else Didn't
None of the new attacks broke WebAuthn or the public-key signing scheme underneath passkeys. Instead, researchers targeted the surrounding plumbing: cloud sync systems, device onboarding flows, recovery mechanisms, and the legacy MFA options most organizations still leave switched on. The result is the same outcome an attacker wants — account takeover — achieved by routing around the hard cryptographic problem entirely.
Pass-ta-key: Malware Hijacks Synced Passkeys
The most detailed research, from Palo Alto Networks' Unit 42, targets Google's synced passkey ecosystem and the Cloud Authenticator used by desktop clients. Dubbed 'Pass-ta-key,' the attack shows that malware already running on a compromised endpoint can abuse onboarding, recovery, and device-trust workflows to seize control of passkey-protected accounts. Unit 42 demonstrated authentication without user interaction, bypassing of user-verification requirements, and extraction of synced passkey private keys — the exact material a passkey is designed to never expose.
"The attacks didn't crack passkey cryptography — they exploited the cloud sync, recovery, and fallback systems built around it."
MFA Downgrade: Skipping the Passkey Entirely
A separate line of research, detailed by WorkOS, points to a simpler weakness: most organizations that roll out passkeys don't remove older authentication methods. SMS codes, authenticator apps, email one-time codes, and password-reset flows typically stay active alongside the new phishing-resistant option. Attackers have learned to skip the passkey challenge altogether and phish the user through one of the fallback paths still sitting in the account settings — a technique researchers now call an MFA downgrade attack.
Why Synced Passkeys Are the Weak Link
The common thread across these findings is synchronization. Passkeys synced across devices through a cloud account — the default for most consumer setups — inherit whatever risk already exists in that cloud account. Compromise the account, the recovery flow, or a device with malware on it, and the passkey's phishing resistance becomes irrelevant, since the attacker never needed to phish anything.
Enterprises Get a Different Recommendation
RSA's analysis of the research draws a clear line between consumer and enterprise use cases. For government agencies, financial services, and other regulated environments, the firm argues that device-bound passkeys — credentials tied to a specific hardware security key or secure enclave, never synced to the cloud — sidestep this entire attack surface. Consumer-grade convenience, in other words, is precisely what creates the opening.
None of this makes passkeys a failed idea; it makes them a technology whose weakest point has moved from the login screen to the infrastructure around it. Security teams evaluating passkey rollouts now face a familiar tradeoff between convenience and attack surface — and the research suggests that fully retiring legacy MFA fallbacks, not just adding passkeys on top of them, is what determines whether the phishing-resistance promise actually holds.
Editorial Note
The research provided comprehensively corroborates the article's core claims about Pass-ta-key attacks targeting Google's synced passkeys, MFA downgrade attacks exploiting legacy authentication methods, and the exploitation of non-cryptographic attack surfaces. All major factual assertions are directly supported by at least one source, particularly the detailed Palo Alto Networks Unit 42 research and WorkOS findings on MFA fallbacks.
Claim Tracker
AI-assessed
Source 5 (Palo Alto Networks Unit 42), Source 4 (WorkOS), and Source 2 all confirm multiple research efforts targeting passkey systems through non-cryptographic means.
Source 5 explicitly states: 'attacks demonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts.'
Source 5 confirms: 'an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey pri[vate keys].'
Source 4 (WorkOS) states: 'The majority of organizations that deploy passkeys or security keys do not remove their existing authentication methods.'
Source 3 (RSA) confirms attacks exploit 'cloud synchronization, recovery flows, and phishing-proxy downgrades' rather than breaking the underlying cryptography.
Ask AI about this story
// discussion
sign in to join the discussion