Passkey Attacks Are Here: What to Check on Your Windows Fleet This Week

If your business has rolled out passkeys in the past year, this month’s research is worth ten minutes of your time. Three separate teams disclosed passkey attacks that get past phishing-resistant MFA. The details point to specific things IT teams should check this week, not a vague “stay alert” warning.

None of these passkey attacks crack the cryptography passkeys rely on. All three need something else first: a compromised endpoint, a logging bug, or a validation step a website skipped. That’s good news in one sense. The fix is mostly about configuration and hygiene, not a wait for some new authentication standard.

What the passkey attacks actually did

At Black Hat USA on 5 August, SpecterOps researcher Michael Grafnetter presented a set of passkey attacks against Windows and Microsoft Entra ID. He showed how Windows had been storing old YubiKey signatures in plain text, readable by any authenticated user on a machine. Chained with a flaw in Entra ID’s passkey checks, those exposed signatures let an attacker impersonate a privileged account. That worked despite phishing-resistant MFA being enforced. Microsoft assigned it CVE-2026-34348 and has released a fix.

Separately, Palo Alto Networks’ Unit 42 broke down how Chrome syncs passkeys through Google Password Manager on Windows devices with a TPM chip. Their worst-case finding is dubbed Golden Pass-ta-key. It pulls the master key protecting every synced passkey straight out of Chrome’s memory during a device re-registration step. There’s currently no way to rotate or revoke that key once it’s exposed. A milder middle variant, Silver Pass-ta-key, forces a device into re-registration. It then lets the attacker enrol their own verification key during that window, so they can sign in later from their own machine.

A third researcher, Dirk-jan Mollema, added another angle to this run of passkey attacks. He showed that malware already inside a signed-in Windows session can use a Windows Hello for Business key. It needs no fresh PIN or fingerprint prompt to do it. That works because the surrounding authentication session isn’t tightly bound to the device making the request.

Why the timing matters

The timing adds pressure to act now rather than later. Microsoft starts auto-enabling passkeys on 1 September for Entra ID users who currently rely on SMS or voice codes. It plans to retire those methods altogether by 1 February 2027. Whatever your current passkey rollout looks like, it’s about to get bigger, whether IT planned for that this quarter or not.

What to check this week

Start with patching. If you run Windows and Microsoft Entra ID, confirm CVE-2026-34348 is applied across your fleet, not just on a handful of test machines. Then ask your IT provider or Microsoft rep directly about the separate Entra-side mitigation for passkey relay assertions. Has it been applied to your tenant? Microsoft has confirmed it exists but hasn’t published full detail, so don’t assume it happened automatically.

Staff might use Chrome with Google Password Manager to sync passkeys on Windows laptops. If so, treat this as a reminder rather than a reason to panic. The Unit 42 attacks all need malware already running on the device first. That puts the priority back on endpoint protection and least-privilege access. Those are the same controls that would stop most other attacks too.

These passkey attacks also expose a gap on the other side of the equation. If your business runs its own web application and accepts passkey logins, check how you validate the “user verified” flag in WebAuthn assertions. Unit 42’s mildest attack succeeded against eBay specifically because that flag wasn’t checked properly. eBay has since fixed it. It’s a one-line validation gap that a code review or a scoped penetration test would normally catch.

What to ask your provider directly

If you outsource IT to a managed service provider, three questions from this research are worth putting to them in writing. First, has CVE-2026-34348 been confirmed patched across every endpoint. That includes laptops that were offline during the last patch cycle. Second, can they confirm the Entra-side mitigation for passkey relay assertions is live on your tenant. Microsoft hasn’t published exactly what that change covers, so don’t take it on trust. Third, what monitoring exists for malware reaching an endpoint in the first place. Every one of these passkey attacks assumes that step has already happened.

Where this fits with compliance

Frameworks such as Cyber Essentials Plus and the NHS Data Security and Protection Toolkit increasingly expect phishing-resistant MFA as evidence of good practice. That’s still the right direction of travel. But “we have passkeys” is not the same claim as “our passkey deployment has been tested end to end”. Auditors are starting to ask the second question.

A short, scoped review will catch most of what these passkey attacks describe. It should cover how passkeys are issued, stored and validated across your Windows fleet and any customer-facing login pages, well before an attacker gets the chance to chain them together.