Full Report
Passkeys eliminate many password-based attacks, but researchers have documented 39 methods for compromising authentication built around them. Token explains how attackers can abuse authentication prompts, synced credentials, enrollment, recovery, and other trust boundaries without breaking FIDO2 cryptography. [...]
Analysis Summary
# Tool/Technique: Passkey Exploitation Framework (39 Documented Methods)
## Overview
While Passkeys (FIDO2/WebAuthn) use public-key cryptography to eliminate traditional password-based attacks, researchers have identified 39 distinct methods to compromise accounts protected by them. These attacks do not break the underlying cryptography; instead, they target the trust boundaries, user interfaces, and synchronization mechanisms surrounding the passkey ecosystem.
## Technical Details
- **Type:** Technique / Exploitation Framework
- **Platform:** Windows, macOS, Android, iOS, Web Browsers (Chrome, Edge, Safari)
- **Capabilities:** Assertion theft, prompt manipulation, enrollment hijacking, and synchronization abuse.
- **First Seen:** Publicized research consolidated September 2026; key research includes "Pass the Passkey" by SpecterOps.
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- [T1555.006 - Credentials from Web Browsers: Password Managers]
- [T1557 - Adversary-in-the-Middle]
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link] (Credential interface deception)
- **[TA0004 - Privilege Escalation]**
- [T1548 - Abuse Elevation Control Mechanism]
- **[TA0003 - Persistence]**
- [T1098 - Account Manipulation] (Malicious enrollment of secondary passkeys)
## Functionality
### Core Capabilities
- **Assertion Mining/Replay:** Identifying and capturing the signed cryptographic response (assertion) to reuse for unauthorized access.
- **Assertion Phishing:** Tricking a user into interacting with a legitimate passkey prompt that is actually being proxied or requested by an attacker-controlled session.
- **User Verification Manipulation:** Bypassing or spoofing the "user presence" or biometric checks required to release a passkey.
- **Circuit Breaker Attacks:** Forcing the authentication flow to fail back to less secure methods (like SMS or email recovery).
### Advanced Features
- **Pass the Passkey:** A technique where malware on a local machine calls the Windows WebAuthn API to generate a valid assertion for an attacker, leveraging the user's existing trust in the OS.
- **Prompt Flooding:** Repeatedly triggering authentication prompts to induce "verification fatigue," leading the user to approve a request out of annoyance.
- **Application Metadata Spoofing:** Making a malicious authentication request appear as if it is originating from a trusted local application (e.g., Outlook or Slack).
- **Sync Abuse:** Exploiting the cloud synchronization of passkeys (e.g., iCloud Keychain, Google Password Manager) to export or share credentials to attacker-controlled devices.
## Indicators of Compromise
- **File Names:** `Pass-the-Passkey` (SpecterOps PoC tooling).
- **Behavioral Indicators:**
- Unusual frequency of `WebAuthn` API calls from non-browser processes.
- Unexpected Bluetooth "Cross-Device" authentication requests (CTAP2).
- Creation of new FIDO2 credentials in user accounts without corresponding help desk tickets.
- Remote Desktop (RDP) sessions attempting to redirect WebAuthn hardware.
## Associated Threat Actors
- While specific APTs are not named in the initial research, these techniques are actively being operationalized for **Initial Access Brokers (IABs)** and **Advanced Phishing Entities** targeting high-value enterprise accounts.
## Detection Methods
- **Behavioral Detection:** Monitoring for "Prompt Fatigue" patterns where multiple WebAuthn assertions are requested in rapid succession.
- **Audit Logs:** Reviewing Identity Provider (IdP) logs for new passkey enrollments from unrecognized IP addresses or device types.
- **Process Monitoring:** Detecting unauthorized processes hooking into browser memory or monitoring window handles associated with the Windows Security/WebAuthn UI.
## Mitigation Strategies
- **Hardware-Bound Biometrics:** Enforce the use of dedicated hardware security keys (e.g., YubiKey, Token Ring) that do not allow private keys to be synced to the cloud.
- **Attestation Requirements:** Configure IdPs to only accept passkeys from specific hardware vendors via FIDO2 metadata service (MDS) attestation.
- **Step-up Authentication:** Require a secondary form of verification for the enrollment of *new* passkeys.
- **User Education:** Training employees to recognize unexpected or repetitive passkey prompts as potential "Pass-the-Passkey" attacks.
## Related Tools/Techniques
- **Adversary-in-the-Middle (AiTM):** Often used in conjunction with assertion capture.
- **Evilginx/M evilginx:** While traditionally for session cookies, these are evolving to handle FIDO2 proxying.
- **Push Bombing:** The predecessor to Passkey prompt flooding.