Phishing-Resistant Does Not Mean Attack-Resistant: Three Passkey Bypasses Landed at Black Hat

Phishing-resistant multi-factor authentication has spent three years as the answer to a hard question. Regulators name it, CISA specifies which methods qualify, and any security programme that reached FIDO2 could reasonably treat credential phishing as a solved category. At Black Hat USA 2026 three separate pieces of research complicated that, and the detail worth sitting with is that none of them defeated the cryptography itself.

On 5 August, SpecterOps principal security researcher Michael Grafnetter presented Pass-the-Passkey. Windows, it turns out, had been storing YubiKey signatures in cleartext, and chaining those recovered signatures with weaknesses in how Microsoft Entra ID validated passkey assertions allowed an attacker to impersonate privileged users, in tenants whose policy explicitly required phishing-resistant MFA. The policy was set correctly. It just did not describe what the system actually enforced.

The Attacks Went Around the Cryptography, Not Through It

Unit 42's contribution, collectively Pass-ta-key, comprised three distinct attacks against Google Password Manager's synced passkeys in Chrome on Windows. The most severe variant, Golden Pass-ta-key, targets the Security Domain Secret, a 32-byte master key, and from it recovers victims' synced passkey private keys. Recovering a private key is a categorically different outcome from phishing a code. A stolen one-time code expires in thirty seconds; a recovered private key is a durable credential that authenticates cleanly forever.

Independent researcher Dirk-jan Mollema showed a third route through Windows Hello for Business: malware already running in a compromised user session can use hardware-bound keys to create fresh authentication material against Entra ID without triggering a new PIN or biometric prompt. The hardware binding held. The assumption that hardware binding implies a human being present at the moment of authentication did not.

Between them the three sit squarely in the space that security architecture tends to leave unexamined: the plumbing between a correct cryptographic primitive and the platform that consumes it. Logging subsystems, credential caches, sync services and validation logic are all rarely in the threat model, because the threat model was drawn around the algorithm.

The affected surface is broad rather than exotic. Between them the three pieces of research touch Windows 10, Windows 11 and Windows Server, Microsoft Entra ID, Google Password Manager in Chrome, and Google Workspace services, with the Workspace case demonstrated against eBay. This is the mainstream enterprise authentication stack rather than a research configuration, which is what distinguishes it from the usual run of conference findings.

Syncing Was the Trade Everyone Accepted

Synced passkeys exist because device-bound credentials were a support disaster. A passkey that lives in one TPM and cannot be recovered means a lost laptop is a lost identity, so the platforms built sync, and sync is why passkeys reached consumer scale at all. It also means the private key exists somewhere other than the secure element, protected by whatever wraps the sync store. Golden Pass-ta-key is an attack on that wrapper, which is to say it is an attack on the design decision that made passkeys usable.

Google removed the Security Domain Secret from Chrome device logging after Unit 42 reported it, and Microsoft issued CVE-2026-34348 against the Windows Event Logging Service at CVSS 6.5, with a spokesperson saying mitigations had been applied for the reported passkey relay assertion issue. Both are appropriate responses to specific bugs. Neither addresses the structural point the researchers raised, which is that there is no rotation or revocation mechanism for a compromised Security Domain Secret. A credential you cannot revoke is a credential whose compromise is permanent.

What This Should and Should Not Change

It should not start a retreat to SMS codes. Phishing-resistant MFA remains the strongest widely deployable authentication available, and every one of these attacks required a foothold, elevated access, or physical proximity that ordinary credential phishing does not. The realistic reading is that the bar moved from "anyone with a convincing login page" to "an attacker already inside the session or the device", which is a substantial improvement even after this research.

What it should change is the sentence security teams say afterwards. Treating phishing-resistant MFA as a control that closes the identity risk category, rather than one that raises its cost, is what leads to under-monitored authentication and unexamined post-authentication behaviour. As this publication's earlier analysis of zero trust implementation gaps found, the controls that fail in practice are usually the ones an organisation had stopped looking at.

• Verify what the policy actually enforces. Pass-the-Passkey worked in tenants configured correctly. Test that an authentication strength policy rejects what it claims to, rather than trusting the setting.
• Monitor after authentication, not just at it. Every one of these attacks produces a successful, well-formed sign-in. Detection has to come from session and privilege behaviour, because the login itself looks perfect.
• Keep device-bound keys for privileged roles. Sync is the mechanism Golden Pass-ta-key attacks. Administrative accounts are the population small enough to absorb the support cost of hardware-bound credentials.
• Ask vendors about revocation, not just strength. There is no rotation path for a compromised Security Domain Secret. Any credential store without a revocation story turns one bad day into a permanent condition.
• Patch the platform, not only the authenticator. CVE-2026-34348 sits in the Windows Event Logging Service. The weak point was the surrounding plumbing, which is not where MFA programmes usually look.

The cryptography behind passkeys came out of Black Hat intact. What did not survive was the comfortable belief that adopting it was the end of the identity conversation rather than the beginning of a better one.