Passkeys have been promoted as one of the strongest replacements for traditional passwords and a major step toward phishing-resistant authentication. However, recent security research and active attacks targeting Microsoft environments show that organizations still cannot rely on passkeys alone to protect user accounts.
Two recent security developments demonstrate the problem from different directions. One involves technical weaknesses surrounding WebAuthn authentication in Windows 11 and Microsoft Entra ID. The other involves attackers using passkeys as a social-engineering lure to compromise Microsoft 365 accounts.
Together, these attacks highlight an important lesson for organizations moving toward passwordless authentication: securing the credential is only one part of securing the authentication process.
Pass-the-Passkey Attacks
Security researchers at SpecterOps recently demonstrated a collection of techniques known as “Pass-the-Passkey” attacks. These attacks show how criminals may be able to abuse passkey authentication without actually stealing the private cryptographic key stored on a user’s device or hardware security key. One of the most serious findings involved Windows 11. During WebAuthn authentication, Windows was logging complete authentication assertions inside Windows Event Logs. These assertions contained information including cryptographic signatures generated during a legitimate passkey authentication. If an attacker gained sufficient access to a compromised Windows computer, they could potentially retrieve this authentication data from the logs. The situation became more serious when researchers examined how Microsoft Entra ID validated WebAuthn authentication requests. According to the research, weaknesses in server-side replay protections could allow previously generated authentication assertions to be reused. This created the possibility of an attacker capturing a valid passkey authentication response from a compromised workstation and replaying it against Microsoft cloud authentication services.MFA Could Still Be Satisfied
What makes this attack particularly concerning is that the attacker may not need the user’s password, physical security key, or passkey private key. The authentication response itself could potentially become valuable to an attacker. This means an attacker could appear to complete an authentication process that satisfies phishing-resistant multifactor authentication requirements even though the legitimate user is no longer involved. This is especially important for privileged accounts. Administrators frequently have access to sensitive Microsoft 365 services, cloud infrastructure, identity management tools, and organizational data. If an administrator authenticates from a compromised workstation, authentication artifacts generated on that computer can become an attractive target.Microsoft Patched the Windows Issue
Microsoft addressed the Windows logging vulnerability as CVE-2026-34348 in its July 14, 2026 security updates. Updated Windows 11 systems no longer store the complete authentication signature in the same manner. Instead, the signature information written to the event logs is truncated, preventing the logged information from being directly reused for authentication while still allowing administrators to retain diagnostic information. Organizations using Windows 11 should make sure systems have received the appropriate security updates, particularly computers used by administrators or employees with access to sensitive resources.Passkeys Are Also Being Used as Phishing Bait
At the same time researchers are examining technical attacks against passkey implementations, attackers are using the growing adoption of passkeys to make traditional social-engineering attacks more convincing. Microsoft Security Research has been tracking cloud intrusions in which attackers impersonate company IT departments and contact employees through phone calls, text messages, and other communication channels. The employee may be told that their passkey, multifactor authentication, or single sign-on configuration needs to be updated immediately. The attacker then directs the victim to what appears to be a Microsoft authentication page. In many cases, however, the attacker does not actually want the victim to create a passkey. The passkey story is simply the excuse used to convince the employee to begin an authentication process.Attackers Can Steal the Session
One method involves an adversary-in-the-middle phishing attack. The malicious website acts as an intermediary between the victim and the legitimate Microsoft authentication service. The victim enters their credentials and completes MFA, but the attacker captures the resulting authentication session. Another technique abuses Microsoft’s device-code authentication process. The victim may even interact with a legitimate Microsoft authentication page and successfully complete MFA. However, the authentication approval actually authorizes a device or application controlled by the attacker. The important distinction is that MFA itself may function correctly. The victim really does authenticate. The problem is that the authentication is being used to establish an attacker-controlled session.Attackers Establish Persistence
Once attackers gain access to a Microsoft 365 account, their next objective may be maintaining that access. Microsoft researchers observed attackers adding new authentication methods to compromised accounts. These methods can include attacker-controlled phone numbers, authenticator applications, or software-based one-time-password tokens. This can make account recovery more complicated. Simply changing the user’s password may not completely remove the attacker if active sessions, refresh tokens, or unauthorized authentication methods remain associated with the account. Incident response teams therefore need to examine the entire identity rather than only resetting the password.Microsoft Graph Becomes a Powerful Reconnaissance Tool
After gaining access, attackers have also been observed using Microsoft Graph to determine what information the compromised user can access. Microsoft Graph is a legitimate and extremely powerful interface used to interact with Microsoft 365 services. Attackers can abuse those same capabilities to enumerate users, groups, roles, applications, SharePoint sites, OneDrive files, mailboxes, and other organizational resources. Individual Graph requests may appear completely normal. The warning sign often comes from the overall pattern of activity. An unusual login followed by a new authentication method, extensive Graph queries, SharePoint searches, OneDrive access, and mailbox activity may indicate that an attacker has compromised the identity and is systematically searching for valuable information.Slow Data Theft Can Be Harder to Detect
Once valuable information is identified, attackers may begin collecting files and email. Microsoft observed activity involving SharePoint Online, OneDrive for Business, and Exchange Online. Instead of immediately downloading enormous amounts of information, some attackers maintained a more controlled pace. Microsoft reported that collection frequently remained below approximately 1,000 files or emails during a one-hour period. This type of activity can be difficult to identify because it may resemble legitimate employee activity when individual events are examined separately. Security teams therefore need to correlate identity events with cloud application activity rather than relying solely on individual IP addresses, domains, or downloads.Passkeys Are Still an Improvement
None of these attacks mean organizations should abandon passkeys. Passkeys and hardware-backed FIDO2 authentication still provide major security advantages over passwords and many traditional MFA methods. They eliminate several common credential-stealing techniques and make conventional phishing substantially more difficult. However, phishing-resistant authentication does not automatically mean phishing-proof infrastructure. An attacker may target the endpoint generating the authentication request, steal an authenticated session, manipulate an enrollment process, abuse legitimate authentication workflows, or simply convince a user to authorize access.Organizations Need Multiple Layers of Protection
Organizations using Microsoft 365 and Entra ID should treat passkeys as one component of a broader identity-security strategy.- Keep Windows 11 endpoints fully patched.
- Require phishing-resistant MFA for privileged accounts.
- Restrict authentication-method registration whenever possible.
- Monitor accounts for newly added MFA methods.
- Require managed or compliant devices for sensitive Microsoft 365 services.
- Restrict device-code authentication when there is no legitimate business requirement.
- Monitor Microsoft Graph activity for unusual reconnaissance patterns.
- Correlate Entra ID sign-ins with SharePoint, OneDrive, Exchange, and Graph activity.
- Revoke active sessions and refresh tokens when an account is compromised.
- Train employees to independently verify unexpected calls or messages claiming to come from IT support.
