{"id":9023,"date":"2026-08-05T23:51:39","date_gmt":"2026-08-05T23:51:39","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9023"},"modified":"2026-08-05T23:51:39","modified_gmt":"2026-08-05T23:51:39","slug":"report-passkey-security-issues-could-allow-account-takeover","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9023","title":{"rendered":"Report: Passkey security issues could allow account takeover"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Given the widespread enterprise adoption of passkeys to replace passwords, a Palo Alto Networks Unit 42 report disclosing ways attackers are getting around passkey protections is concerning, analysts say, but they stress that the demonstrated attacks can only happen after a successful intrusion.<\/p>\n

They also pointed out that the issues are not strictly caused by holes in passkeys so much as by weaknesses in the procedures surrounding them.\u00a0<\/p>\n

\u201cThe researchers didn\u2019t break the underlying cryptography. They exploited the seams around it: onboarding flows, recovery mechanisms and trust signals that weren\u2019t being validated,\u201d said Justin Greis<\/a>, CEO of consulting firm Acceligence. \u201cThat distinction matters because it tells us where the actual risk lives.\u201d<\/p>\n

The Palo Alto report<\/a> showed attacks that, it said, \u201cdemonstrate how malware on a compromised endpoint can misuse onboarding, recovery and device trust workflows to take over passkey-protected accounts,\u201d as well as \u201chow an attacker can authenticate without user interaction, bypass user verification requirements and extract all synced passkey private keys.\u201d<\/p>\n

Palo Alto described three categories of attack, collectively dubbed Pass-ta-key: Pass-ta-key, where an\u00a0attacker takes over an account protected by a Google-synced passkey using malware running on the victim\u2019s device, without requiring privilege escalation, device unlock or user interaction; Silver Pass-ta-key, which involves an attacker tricking Google Cloud Authenticator into believing the victim has unlocked the device with biometrics, leading to full account takeover without using the victim\u2019s device during authentication; and Golden Pass-ta-key, which allows an attacker to extract all synced passkeys in a form that lets them be shared or sold on the credential black market.<\/p>\n

Given the complexity of most global enterprise threat surfaces, some CISOs have struggled<\/a> with adapting passwordless processes to environments with legacy and virtual environments.\u00a0Passcodes have been recently embraced<\/a> by enterprise CISOs as the first step in implementing a passwordless strategy.<\/p>\n

Analysts and consultants in the main agreed that the flaw Palo Alto reports is significant, despite the fact that it assumes the attacker has already penetrated an environment and successfully installed malware. Sadly, given that such penetration only requires one privileged user anywhere to accidentally click on a poisoned link or attachment, the assumption of prior penetration is likely valid.<\/p>\n

Implementation issues are the problem<\/h2>\n

What the report reveals is less about any flaws within passcodes directly, and more about the lack of attention paid to a wide range of mechanisms surrounding them.\u00a0<\/p>\n

Greis said CISOs now need to focus on what to do, and what to test, based on the assumption that user behavior is not always as expected.\u00a0<\/p>\n

In several cases cited in the report, he pointed out, issues occurred \u201cnot because the standard is flawed, but because implementations haven\u2019t caught up to it. It mirrors what we\u2019ve seen repeatedly in security: the specification is sound, but the ecosystem implementing it is uneven.\u201d<\/p>\n

Consultant Brian Levine<\/a>, executive director of FormerGov, agreed.\u00a0<\/p>\n

\u201cOn any service where your organization is the relying party, require user verification and actually validate the user-verified flag in the authentication response,\u201d he said. \u201cThe researchers found real-world services accepting logins without it, which quietly collapses a multi-factor login back into a single factor.\u201d<\/p>\n

Frank Dickson<\/a>, group VP for security at IDC, added that he would stress to CISOs that this attack assumes a prior successful penetration.\u00a0<\/p>\n

\u201cThis isn\u2019t passkeys getting hacked from across the internet. It\u2019s what [an attacker] does once they\u2019re already inside the house. So the real headline is that \u2018phishing resistant\u2019 stops being resistant the moment the endpoint stops being clean,\u201d he said.<\/p>\n

\u201cStop treating verification as optional,\u201d he advised. \u201cFlip it to required, check it server side every single time, and save your hardware bound keys, the YubiKeys of the world, for the accounts that matter most. A key that never leaves a physical device is a key no attacker can ever harvest in bulk.\u201d<\/p>\n

Or Finkelstein<\/a>, head of marketing at Secret Double Octopus, agreed that CISOs have gotten complacent about the way in which systems support passkeys.<\/p>\n

\u201cCISOs should probably look at how user verification is enforced, how enrollment and recovery work, have a clear and enforced policy on whether credentials are synced or device-bound, and have some ITDR system to quickly mitigate suspicious endpoints and authenticators,\u201d he said. \u201cIn most serious enterprise environments, EDR and device management reduce the likelihood of initial attacks, but do not close every post-compromise attack path.\u201d<\/p>\n

Poor support processes weaken passkeys<\/h2>\n

Some have argued that the lack of sufficiently robust support processes actually weakens passkey capabilities and undermines the whole point of such systems.<\/p>\n

J. Wolfgang Goerlich<\/a>, a member of the faculty of IANS and a longtime cybersecurity consultant, pointed out that the original FIDO2 spec eliminated credential theft by binding the private key to a physical authenticator. Synced passkeys reintroduced credential portability and therefore reintroduced the form of credential theft risk cited in the Palo Alto report.<\/p>\n

\u201cA passwordless system is exactly as strong as the flow that re-establishes it,\u201d he said. \u201cBoth serious techniques here start by forcing a device to re-enroll. Many security teams have never modeled, never monitored and never rehearsed a response to this.\u201d<\/p>\n

Goerlich\u2019s advice to CISOs is to require device-bound authenticators, such as hardware tokens or computers, for all privileged and sensitive access. They may consider allowing wallets for lower risk access, he said, \u201chowever, much like passwords in Web browsers have long been at risk, we must now consider passkeys in the browsers an unacceptable risk.\u201d<\/p>\n

\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Given the widespread enterprise adoption of passkeys to replace passwords, a Palo Alto Networks Unit 42 report disclosing ways attackers are getting around passkey protections is concerning, analysts say, but they stress that the demonstrated attacks can only happen after a successful intrusion. They also pointed out that the issues are not strictly caused by […]<\/p>\n","protected":false},"author":0,"featured_media":9024,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9023","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9023"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9023"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9023\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9024"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9023"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9023"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9023"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}