New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed, abused a cloud-synced passkey system from malware already on the victim's machine, and used a

The report says three research efforts showed ways to defeat passkey protections without breaking the underlying cryptography, including reuse of exposed Windows authentication material, malware abuse of Google Password Manager's synced passkeys, and use of a Windows Hello for Business key from an already signed-in session.[1][2] The most serious cases involved recovering synced private keys or bypassing user-verification checks, which turns a strong authentication method into an endpoint and cloud-account exposure problem rather than a cryptographic failure.[1][2] RealGround analysis: this is best classified as data leakage because sensitive authentication material and passkey secrets were exposed or extracted, creating account-takeover risk and warranting endpoint hardening, sync-architecture review, and red-teaming of passkey flows.