huntress.comarticlePasskeys Raise the Bar. Here’s Where Attackers Can Still Get In.
Huntress post on where accounts remain exposed after a passkey rollout. It covers passkey-themed social engineering, the EvilTokens device-code phishing campaign (344 organizations in about 16 days), weak enrollment and recovery, SpecterOps research on Windows WebAuthn hooking on compromised endpoints, and the trade-offs between synced and device-bound passkeys. It closes with ITDR-style post-login monitoring, containment steps (revoke sessions, remove rogue authenticators, hunt inbox rules, OAuth grants, forwarding), and a five-question deployment checklist.
TL;DR Passkeys aren't broken, but attackers still win via device-code phishing, enrollment/recovery abuse and compromised endpoints; layer ITDR, EDR and training around them.
Organisations named here
Technologies named here
- WebAuthn
- FIDO2
- Passkeys
- Microsoft device code authentication flow
- Endpoint detection and response agent
- Windows WebAuthn interactions
- FIDO2/WebAuthn hardware security keys
- Non-phishing-resistant MFA
- Hardware tokens generating one-time codes
- Phishing-resistant authentication
- Windows
- EDR
- Huntress
- CISA
- Identity Threat Detection and Response
Techniques named here
- Passkey-themed phishing
- Device code phishing
- Phishing-as-a-service
Threat actors named here
Related in Identity & Access
huntress.comarticleEducation Under Attack: The Pattern Behind Recent University Breaches
huntress.comarticleNext-Gen Phishing Tactics Users Aren’t Ready For | Huntress
.png)
aikido.devwriteupGoogle API keys keep working after you delete them
