Full Report
Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed, abused a cloud-synced passkey system from malware already on the victim's machine, and used a
Analysis Summary
# Tool/Technique: Passkey Replay & Sync Exploitation
## Overview
This entry covers three distinct research-driven techniques designed to bypass the security guarantees of FIDO2 passkeys. These methods do not break the underlying cryptography (public-key infrastructure) but instead exploit implementation flaws in Windows logging, Google Chrome’s synchronization mechanism, and Windows Hello’s session management. The goal is to bypass phishing-resistant Multi-Factor Authentication (MFA) and impersonate privileged users.
## Technical Details
- **Type**: Technique / Vulnerability Research
- **Platform**: Windows (10, 11, Server), Google Chrome, Microsoft Entra ID
- **Capabilities**: Replay of authentication signatures, extraction of synced private keys, and unauthorized use of hardware-bound keys.
- **First Seen**: August 2026 (Reported at Black Hat USA 2026)
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- **[T1555.003 - Credentials from Web Browsers]**: Targeted extraction from Google Password Manager.
- **[T1552.001 - Credentials In Files]**: Accessing signatures stored in Windows logs.
- **[TA0004 - Privilege Escalation]**
- **[T1068 - Exploitation for Privilege Escalation]**: Using CVE-2026-34348 to escalate or impersonate.
- **[TA0008 - Lateral Movement]**
- **[T1550 - Use Alternate Authentication Material]**: Pass-the-Passkey (Replay attack).
## Functionality
### Core Capabilities
- **Signature Replay (SpecterOps)**: Exploits **CVE-2026-34348**, where the Windows Event Logging Service stores YubiKey/FIDO2 signatures in cleartext. Attackers can read these signatures and replay them to Microsoft Entra ID to satisfy MFA requirements without possessing the physical token.
- **Synced Key Extraction (Palo Alto Unit 42)**: Targets "Pass-ta-key" in Google Password Manager. If malware is on the machine, it can recover the master key/private keys for synced passkeys from Chrome’s cloud-synced system.
- **Session Abuse (Dirk-jan Mollema)**: Malware running in an active user session can leverage hardware-bound Windows Hello for Business keys to sign authentication requests without triggering a fresh biometric or PIN prompt.
### Advanced Features
- **Phishing-Resistance Bypass**: Directly circumvents the "unphishable" nature of FIDO2 by moving the attack to the post-authentication or synchronization layer.
- **Cross-Platform Impersonation**: Reusing material harvested from a local Windows endpoint to gain access to cloud-based Entra ID resources.
## Indicators of Compromise
- **File Hashes**: *N/A (Techniques rely on native OS/Browser processes)*.
- **Registry Keys**: Monitoring access to registry keys associated with Chrome’s encrypted local state or Windows Hello container keys.
- **Network Indicators**: Look for anomalous logins to `login.microsoftonline[.]com` using replayed assertions.
- **Behavioral Indicators**:
- Unauthorized processes reading `Event Log` files (specifically searching for signature material).
- Unexpected calls to `lsass.exe` or Windows Hello APIs without user presence verification.
- Suspicious access to Chrome’s User Data folder (e.g., `Default\Login Data`).
## Associated Threat Actors
- While currently demonstrated by security researchers (SpecterOps, Unit 42, Dirk-jan Mollema), these techniques are highly likely to be adopted by **Advanced Persistent Threat (APT)** groups and **Information Stealer** malware operators (e.g., Lumma, RedLine) for session hijacking.
## Detection Methods
- **Signature-based**: Detect exploitation of **CVE-2026-34348** via specific Windows Event Log queries looking for unauthorized access to security logs.
- **Behavioral**: Monitor for unusual credential relay behavior in Entra ID logs (e.g., the same authentication assertion used twice).
- **YARA**: Use rules to detect malware attempting to extract Google Chrome’s "Local State" or master keys.
## Mitigation Strategies
- **Patch Management**: Apply Microsoft security updates for **CVE-2026-34348** to prevent signature logging.
- **Least Privilege**: Implement a Zero Trust model to ensure even if an MFA assertion is replayed, the attacker has limited movement.
- **Device Binding**: Prefer device-bound (hardware-only) passkeys over synced passkeys for high-privilege accounts to mitigate the "Pass-ta-key" (Unit 42) vector.
- **Session Security**: Configure Windows Hello to require frequent re-authentication (PIN/Biometric) for sensitive operations to mitigate Mollema’s session abuse technique.
## Related Tools/Techniques
- **Pass-the-Hash / Pass-the-Ticket**: Traditional replay attacks adapted for modern credentials.
- **Token Theft**: Stealing session cookies to bypass MFA, which these techniques aim to complement or replace.