Reported by 2 outlets

Timeline

1. original reporting

   "Pass-the-Passkey" Attack Family Breaks Phishing-Resistant MFA Without Touching Private Keys

   cyberpress.org · 64d ago · August 11th, 2026

   SpecterOps disclosed more than 20 Pass-the-Passkey techniques that undermine WebAuthn passkey protections across Windows 11, Microsoft Entra ID, browsers, password managers, and enterprise authentication workflows — without breaking FIDO2 cryptography or extracting private keys from hardware security keys. Instead, the attacks exploit the ecosystem around passkeys: endpoint logging gaps, weak server-side assertion validation, and authentication-prompt and application-interface weaknesses. The most serious chain combines a Windows event logging flaw with insufficient WebAuthn assertion validation to impersonate privileged enterprise users. The research challenges the assumption that passkeys are inherently replay- and session-abuse-proof.

2. update from gbhackers.com

   Pass-the-Passkey Attack Exploits Windows and Entra ID to Bypass MFA

   gbhackers.com · 63d ago · August 11th, 2026

   Security researchers have recently revealed a new attack family named “Pass-the-Passkey,” which enables adversaries to impersonate enterprise users and circumvent phishing-resistant multi-factor authentication (MFA) protections in Windows 11 and Microsoft Entra ID environments. Pass-the-Passkey Attack Exploits Windows The attack does not involve extracting a passkey’s private cryptographic key from a FIDO2 security key, Windows Hello container, or other trusted hardware. Instead, it exploits weaknesses in the surrounding WebAuthn implementation and validation workflow, turning previously generated authentication data into reusable identity artifacts. Researchers at SpecterOps discovered that Windows 11 could log complete WebAuthn assertion responses in the Microsoft-Windows-WebAuthN/Operational event log. These assertions may contain crucial information, including the challenge, authenticator data, credential ID, user handle, and signature required during passkey authentication. Pass-the-Passkey Attacks Overview (Image Source: Specterops.io) In certain scenarios, low-privilege users, and sometimes even remote users with access to the event log, could retrieve assertion data generated during another user’s passkey login. The second part of this attack chain relates to Microsoft Entra ID’s server-side passkey validation. According to the research, Entra ID did not ade

3. update from cyberpress.org

   Pass-the-Passkey Attack Bypasses Phishing-Resistant MFA and Impersonates Privileged Users

   cyberpress.org · 63d ago · August 11th, 2026

   A newly disclosed “Pass-the-Passkey” attack family demonstrates how implementation weaknesses in WebAuthn can undermine passkey protections, even when private keys remain within hardware security keys or trusted device enclaves. A WebAuthn assertion is a signed authentication response generated after a user approves a passkey request. Although an assertion is not the private passkey itself, it remains sensitive authentication material that should not be reusable outside its original login transaction. WebAuthn Authentication Flow (Source: Specterops[.]io) SpecterOps found that users with local access to an affected system could retrieve