Three research teams recently uncovered flaws in passkey systems from Microsoft and Google, allowing attackers to bypass phishing-resistant Multi-Factor Authentication without breaking any cryptographic primitives. These attacks exploited Windows logging, cloud service validation, and browser memory storage of recovery secrets.
What the Research Shows
SpecterOps found a vulnerability involving Windows and Microsoft Entra ID that enabled privileged-user impersonation while still meeting phishing-resistant MFA policies. Windows stored past YubiKey signatures in cleartext, accessible to authenticated unprivileged users. By combining these signatures with weaknesses in Entra ID's passkey validation, attackers could impersonate users.
The Windows vulnerability is tracked as CVE-2026-34348, an information-disclosure issue in the Windows Event Logging Service with a CVSS score of 6.5. Microsoft has released a security update and applied mitigations for the Entra-side passkey relay issue, though the public advisory only covers the Windows logging flaw.
Unit 42 targeted Google Password Manager's synced-passkey system in Chrome on Windows. Their attack, Golden Pass-ta-key, recovers the Security Domain Secret, a 32-byte Key Encryption Key (KEK) protecting synced passkeys. Initially exposed in Chrome's device logging, Google removed it, but Unit 42 found it still temporarily present in Chrome's process memory during re-registration. With this secret, attackers can recover synced passkey private keys. Google's current setup doesn't allow for rotating or revoking the Security Domain Secret.
Independent researcher Dirk-jan Mollema demonstrated that malware in a signed-in Windows session can use a hardware-bound Windows Hello for Business key without user re-authentication. A low-privilege process can access Windows cryptographic interfaces to use the key without a new PIN or biometric prompt. Mollema discovered that the Entra WebAuthn challenge is valid for five minutes and isn't tied to a session, user, or tenant. An attacker can request a challenge on their system, sign it on the victim's machine using the Windows Hello key, and return it as a valid assertion.
What This Means for Your Team
These aren't remote-exploit chains. Unit 42's attacks start with malware on the endpoint, and Mollema's begins inside an already compromised session. Your authentication controls must contain damage after an endpoint compromise, not just prevent initial access.
The overlap between SpecterOps and Mollema's findings suggests Entra ID's passkey validation may have treated certain authentication materials as more trustworthy than warranted. Microsoft's response doesn't clarify whether the two chains exploited the same Entra validation issue or different checks with similar outcomes.
The debate over synced versus device-bound passkeys also changes. Device-bound passkeys don't prevent Mollema's session-hijacking technique, while synced passkeys expose the recovery architecture targeted by Unit 42. Neither option closes the broader attack surface if surrounding controls fail.
Microsoft is raising the stakes. Starting September 1, 2026, Entra ID users currently enabled for SMS or voice authentication will be automatically enabled for passkeys and encouraged to register them. Microsoft will retire SMS and voice delivery on February 1, 2027. This timeline pressures getting implementation details right before the user base expands.
Action Items by Priority
Immediate (this week):
Install Microsoft's security updates for CVE-2026-34348 across Windows 10, Windows 11, and Windows Server systems to close the Windows Event Logging Service information-disclosure path SpecterOps used.
Review your Entra ID Conditional Access policies. If you require phishing-resistant authentication, add device compliance checks and continuous access evaluation. Microsoft's mitigations for the passkey relay issue aren't detailed in public advisories, so layering controls reduces reliance on a single validation point.
Short-term (next 30 days):
Audit WebAuthn relying-party configurations. If your service requests user verification, enforce it. Unit 42 demonstrated their technique against eBay, which changed its validation of the WebAuthn user-verification flag after the report. Check your implementation.
Monitor Entra ID sign-in logs for Windows Hello for Business authentications without a device identifier claim and unexpected device registrations. Mollema's technique can produce tokens lacking device ID claims, opening a route to Primary Refresh Tokens and additional persistence.
Treat passkey stores, recovery flows, and browser memory as credential-sensitive in your endpoint detection rules. Unit 42 found the Security Domain Secret in Chrome's process memory. Your endpoint defenses should flag unusual access to browser process memory and cryptographic key stores.
Ongoing:
Map your authentication architecture to identify where signed assertions, recovery secrets, or session state could be reused. SpecterOps exploited reusable signed assertions. Unit 42 targeted recovery architecture. Mollema used session state. These are different attack surfaces requiring different controls.
If deploying synced passkeys, document recovery and secret-rotation procedures. Google's current setup doesn't allow for rotating the Security Domain Secret, making compromise more persistent than a single captured login. Your architecture needs an answer to "what happens if the Key Encryption Key (KEK) leaks?"
Test your passkey implementations assuming malware is already on the endpoint. NIST SP 800-63B describes authenticator assurance levels, but these findings show that the surrounding platform controls matter as much as the authenticator itself.
