39 Published Attacks on Passkeys: The Cryptology Holds, the Ecosystem Does Not

Passkeys were supposed to end the credential fight. A running inventory of 39 documented attack methods says the fight just moved somewhere most enterprises are not watching.

If your security roadmap leans on passkeys, the news this week is not the doom you might expect. It is stranger. There are now at least 39 publicly documented attack paths against passkeys and the systems wrapped around them, catalogued in a piece carried on BleepingComputer, and almost none of them break the cryptography. The math holds. Everything beside the math is what attackers are busy picking apart.

The private key never has to leave the device

SpecterOps’ “Pass the Passkey” research makes the point cleanly. Malware on a compromised Windows box does not need to extract a private key from the TPM. It can simply ask the legitimate WebAuthn stack to sign an assertion. The employee sees a normal Windows hello prompt, taps the fingerprint, and walks away. The attacker collects the signed assertion and authenticates as that user. Nothing was stolen. Nothing was cracked. The authentication ceremony was pointed at the wrong master.

The published techniques read like a layer-by-layer audit of your identity stack: assertion mining, assertion replay, challenge injection, browser hooking, user verification bypass, prompt flooding, window handle spoofing, FIDO interface overlays. Several are already turning up in real attack chains rather than staying inside research demos.

Synchronization is the trade-off nobody priced in

Passkeys feel safe because they live in your phone and quietly follow you across devices through iCloud or Google. That convenience is the surface. The inventory includes synced vault compromise, cloud account takeover, KeePassXC and Bitwarden export theft, rooted handsets, malicious browser extensions, and CTAP/Bluetooth transport abuse.

A synced passkey carries very strong cryptography and inherits every weakness of the phone, the operating system, the password manager, the cloud account, and the recovery flow that manage it. The security boundary is no longer the authenticator. It is the least trusted component in the chain.

The quiet killer: enrollment

Some of the most effective attacks never touch an existing passkey. They make a new one. Shadow passkeys, enrollment vishing, help desk takeover, SIM-swap recovery, reverse vishing, migration pretexts. An attacker who gains enough control of an account to register a device does not need your credential at all. The legitimate service happily mints a valid one for them.

Here is the uncomfortable takeaway for any CISO who greenlit a passkey rollout last year: phishing-resistant login means very little if enrollment, replacement, and recovery are still guarded by a call center and a security question.

What this means for African enterprises

South African banks and fintechs are pushing passkey-based login hard, and the move is right in principle. Passwords were losing. But the same institutions run help desks that will add a device to an account on a phone call, and many employees keep work credentials inside consumer cloud sync. Those are the two soft spots the 39 methods exploit.

The practical fixes are not exotic. Require an already-approved authenticator to approve a new one. Lock enrollment and recovery behind out-of-band verification instead of SMS. Restrict high-value accounts to specific authenticator classes. Stop letting weaker methods become silent fallback paths.

I keep coming back to one line from the research: phishing resistance at the protocol layer is not deception resistance at the operating system, browser, and help desk layers. The FIDO2 ceremony is the most defended part of the flow now. Everything around it is where the money is going.

Where eHawu fits

Passkeys are one signal in an authentication decision, not the whole decision. eHawu’s network-layer controls sit in the gap the research exposes: every session rides a zero-trust path where the device posture, the route, and the identity get checked together, and credential operations like enrollment and recovery are policy-gated rather than left to whoever answers the phone. Against an attacker who wins by riding legitimate flows, the answer is owning the flow. That is what eHawu secures.