Passkey attack research exposes Windows, Chrome and Entra weaknesses

Three research teams have shown how passkey deployments can be abused without breaking the FIDO2 cryptography behind them. SpecterOps demonstrated a Windows and Microsoft Entra ID chain tied to CVE-2026-34348; Unit 42 described attacks on Google Password Manager synced passkeys in Chrome on Windows; and researcher Dirk-jan Mollema showed how malware in a signed-in Windows session could use a Windows Hello for Business key without a fresh PIN or biometric check.

The findings do not describe one universal passkey failure. They concern different surrounding controls: retained authentication data, cloud-synced key protection, browser and device trust handling, and the ability to invoke a legitimate hardware-backed credential from an already compromised endpoint.

Windows signatures and Entra authentication paths

SpecterOps presented its Pass-the-Passkey research at Black Hat USA 2026. The firm said Windows stored historical YubiKey signatures in cleartext where authenticated, unprivileged users, including remote users, could access them. By combining those signatures with weaknesses in Entra ID passkey validation, the researchers said an attacker could impersonate privileged users while meeting policies that require phishing-resistant MFA.

The Windows issue, CVE-2026-34348, is an information-disclosure vulnerability in the Windows Event Logging Service with a Microsoft CVSS score of 6.5. Microsoft lists Windows 10, Windows 11 and Windows Server releases as affected, although that product scope does not prove the full SpecterOps chain works identically on every release. The attack does not extract a private key from a YubiKey; it reuses an authentication signature Windows retained and that Entra ID accepted in the reported chain.

Microsoft released a security update for the logging vulnerability and said it had applied mitigations for the reported passkey relay assertions. The company continues to recommend least privilege, phishing-resistant authentication and endpoint protections within a Zero Trust model. The investigation also extends themes in click-based intrusion chains and AI-agent incidents, where click-based intrusion chains and AI-agent incidents illustrated how trusted controls can be misused after initial access.

Synced keys and Windows Hello use after compromise

Unit 42 targeted Google Password Manager’s synced-passkey implementation in Chrome on Windows. Its three reported paths require malware already running on the victim endpoint and do not require an administrator privilege escalation. One technique abused Chrome device identity functions to obtain signatures that let malware act as a legitimate Google Password Manager client without a new device unlock or user interaction.

The most serious variant, Golden Pass-ta-key, targets the 32-byte Security Domain Secret that protects synced passkeys. Unit 42 found the secret in Chrome device logging, which Google removed after disclosure, but said it remains temporarily available in process memory during re-registration. Possession of the secret can allow recovery of a victim’s synced passkey private keys. Unit 42 said the current implementation offers no way to rotate or revoke that secret.

Mollema’s work concerns Windows Hello for Business keys, which are commonly protected by a Trusted Platform Module and cannot simply be exported. A low-privilege process in an already compromised user session could nevertheless call Windows cryptographic interfaces to use the key without prompting for a new PIN or biometric verification. He used that key as a FIDO2 credential against Entra ID.

Controls beyond the authenticator

Mollema found that an Entra WebAuthn challenge could remain valid for five minutes without being bound to a session, user or tenant. An attacker could request a challenge on one system, have it signed on the victim machine and return the assertion. The resulting sign-in could satisfy Conditional Access rules requiring phishing-resistant authentication. He also observed tokens without a device ID claim, creating a potential route through device registration to a Primary Refresh Token and further persistence.

Businesses should install applicable Microsoft updates for CVE-2026-34348, ensure services enforce the WebAuthn user-verification requirement they request, and treat browser memory, passkey stores and recovery flows as credential-sensitive assets. Entra teams should also investigate unusual Windows Hello for Business authentications without device identifiers and unexpected device registrations, because endpoint compromise can undermine controls around both synced and device-bound passkeys.